CVE-2021-31812

Apache PDFBox vulnerability CVE-2021-31812: a specially crafted PDF can trigger an infinite loop while loading, affecting version 2.0.23 and all prior 2.0.x. Impact is listed as High for availability (DoS via resource exhaustion). The provided documents confirm the affected product/component and ...

CVE-2021-31811

CVE-2021-31811: Apache PDFBox 2.0.23 and earlier is vulnerable to an OutOfMemoryError when loading a crafted PDF. IBM/QRadar advisories confirm the issue and recommend upgrading PDFBox to v2.0.24 (via PJ46568 iFix/FIXPACK) or newer.

CVE-2021-27807

CVE-2021-27807 affects Apache PDFBox 2.0.22 and earlier 2.0.x. The issue arises when loading a crafted PDF, triggering an infinite loop and causing denial of service. Connected IBM advisories confirm the same description and map remediation to upgrading to fixed PDFBox versions via product-specif...

CVE-2021-27906

CVE-2021-27906 affects Apache PDFBox; a crafted PDF can trigger an OutOfMemoryError when loading, impacting PDFBox 2.0.22 and earlier 2.0.x. The connected IBM/QRadar security bulletin confirms the same CVE ID and notes remediation: upgrade to IBM Cognos-related 2.0.6.12, then apply FixPack 2.0.6....

CVE-2018-11797

CVE-2018-11797 affects Apache PDFBox 1.8.0–1.8.15 and 2.0.0-RC1–2.0.11, where parsing the PDF page tree can trigger an extremely long computation (denial of service). The issue is caused by the page-tree parsing logic; exploitation details are not provided in the documents. Connected sources conf...

CVE-2026-23907

Summary (CVE-2026-23907) Apache PDFBox’s ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) where the filename from PDComplexFileSpecification.getFilename() was appended to the extraction path. Affected versions: 2.0.24–2.0.35 and 3.0.0–3.0.6. Subsequent releases 2.0.3...