pdfbox: OutOfMemory-Exception while loading a crafted PDF file

🗓️ 11 Aug 2021 18:21:58Reported by RedHatType

A crafted portable document format triggers an out of memory on load in Apache PDFBox versions 2.0.22 and earlier.

Reporter	Title	Published	Views	Family All 62
IBM Security Bulletins	Security Bulletin: Watson Explorer is affected by Apache PDFBox vulnerabilities (CVE-2021-27807, CVE-2021-27906, CVE-2021-31811, CVE-2021-31812)	19 Jul 202109:24	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Risk Manager on CP4S is affected by multiple vulnerabilities	18 Oct 202114:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DataQuant Fix for (All) Apache PDF Box (Publicly disclosed vulnerability)	28 Jun 202119:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Compare and Comply for IBM Cloud Pak for Data affected by vulnerability in Apache PDFBox	14 Jul 202120:51	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities including a remote code execution in Spring Framework (CVE-2022-22965)	11 Apr 202215:17	–	ibm
IBM Security Bulletins	Security Bulletin: Apache PDFBox as used by IBM QRadar Incident Forensics is vulnerable to denial of service (CVE-2021-27807, CVE-2021-27906)	23 Jul 202113:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Apache PDFBox	25 Jun 202100:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities	2 Dec 202121:41	–	ibm
Circl	CVE-2021-27906	19 Mar 202119:33	–	circl
CNNVD	Apache PDFBox 安全漏洞	19 Mar 202100:00	–	cnnvd

Vulners

Node

AND

Source	Link
access	www.access.redhat.com/security/cve/CVE-2021-27906
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-27906
cve	www.cve.org/CVERecord

18 Jul 2026 23:21Current

7.2High risk

Vulners AI Score7.2

CVSS 24.3

CVSS 3.15.5

EPSS0.03337