A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading a tiny file
Priority LOW 31CWE-789Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 1 fixed, 6 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-789.
Summary
In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
Why it matters now
EPSS 0.03572 89th percentileScored 2026-11-07
Fix Partial Apache PDFBox (Apache Software Foundation): 2.0.24org.apache.pdfbox:pdfbox (Maven): 2.0.24+1 more productRed Hat: 1 advisoryRed Hat: 1 fixed, 6 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache PDFBox | Apache PDFBox to before 2.0.24 | 2.0.24 | Patch available | CNA |
| — | org.apache.pdfbox:pdfbox (Maven) | 2.0.0 to before 2.0.24 | 2.0.24 | Patch available | GHSA-fg3j-q579-v8x4 |
| — | org.apache.pdfbox:pdfbox-parent (Maven) | 2.0.0 to before 2.0.24 | 2.0.24 | Patch available | GHSA-fg3j-q579-v8x4 |
- Apache PDFBox VendorApache Affected Apache PDFBox to before 2.0.24 Fixed in 2.0.24 Patch available CNA
- org.apache.pdfbox:pdfbox (Maven) Vendor— Affected 2.0.0 to before 2.0.24 Fixed in 2.0.24 Patch available GHSA-fg3j-q579-v8x4
- org.apache.pdfbox:pdfbox-parent (Maven) Vendor— Affected 2.0.0 to before 2.0.24 Fixed in 2.0.24 Patch available GHSA-fg3j-q579-v8x4
CPE configurations NVD · 23
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:pdfbox:*:*:*:*:*:*:*:* | 2.0.0 – 2.0.23 | Vulnerable | Apache |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:* | 14.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:* | 14.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:* | 14.5.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:* | 14.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:* | 14.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:* | 14.5.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:*:*:*:*:*:*:* | 14.2.0 | Vulnerable | Oracle |
- cpe:2.3:a:apache:pdfbox:*:*:*:*:*:*:*:* Versions 2.0.0 – 2.0.23 Vulnerable ·Apache
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
Show 13 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:banking_supply_chain_finance:14.3.0:*:*:*:*:*:*:* | 14.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_supply_chain_finance:14.5.0:*:*:*:*:*:*:* | 14.5.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_trade_finance:14.5:*:*:*:*:*:*:* | 14.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_treasury_management:14.5:*:*:*:*:*:*:* | 14.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_universal_banking:*:*:*:*:*:*:*:* | 14.0.0 – 14.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_universal_banking:14.5:*:*:*:*:*:*:* | 14.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:outside_in_technology:8.5.5:*:*:*:*:*:*:* | 8.5.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* | 17.7 – 17.12 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* | 18.8 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:* | 19.12 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:* | 20.12 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:18.1:*:*:*:*:*:*:* | 18.1 | Vulnerable | Oracle |
| cpe:2.3:o:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:* | 8.1 | Vulnerable | Oracle |
- cpe:2.3:a:oracle:banking_supply_chain_finance:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_supply_chain_finance:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_trade_finance:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_treasury_management:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_universal_banking:*:*:*:*:*:*:*:* Versions 14.0.0 – 14.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_universal_banking:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:outside_in_technology:8.5.5:*:*:*:*:*:*:* Versions 8.5.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* Versions 17.7 – 17.12 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* Versions 18.8 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:* Versions 19.12 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:* Versions 20.12 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:18.1:*:*:*:*:*:*:* Versions 18.1 Vulnerable ·Oracle
- cpe:2.3:o:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Oracle
Remediation
- Fix · CNA Apache PDFBox (Apache Software Foundation) Fixed in 2.0.24
- Fix · GHSA-fg3j-q579-v8x4 org.apache.pdfbox:pdfbox (Maven) Fixed in 2.0.24 Advisory →
- Fix · GHSA-fg3j-q579-v8x4 org.apache.pdfbox:pdfbox-parent (Maven) Fixed in 2.0.24 Advisory →
Red Hat 1 advisory
- RHSA-2021:3205 Released 2021-08-18 · Red Hat rating ModerateRed Hat Integration Camel-K 1.4 release and security update
- Red Hat Integration
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Apache PDFBox — FEDORA-2021-4a9ead5fff
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2021-11809 A carefully crafted PDF file can trigger an infinite loop while loading the filePriority LOW 30
- Advisory ·
Apache PDFBox — FEDORA-2021-3d94c14be4
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2021-11809 A carefully crafted PDF file can trigger an infinite loop while loading the filePriority LOW 30
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat BPM Suite 6 | Affected | No fix planned: Out of support scope |
| Red Hat Fuse 7 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss BRMS 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat Integration | Fixed | RHSA-2021:3205 |
Timeline
- 2026-10-02 Threatist record created from CVE-2021-31811
- 2026-10-03 Alias added: GHSA-fg3j-q579-v8x4
References
Patch 2
Advisory 7
- https://lists.apache.org/thread.html/re3bd16f0cc8f1fbda46b06a4b8241cd417f71402809baa81548fc20e%40%3Cusers.pdfbox.apache.org%3E
- [oss-security] 20210612 CVE-2021-31811: Apache PDFBox: A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading a tiny file
- FEDORA-2021-4a9ead5fff
- FEDORA-2021-3d94c14be4
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://nvd.nist.gov/vuln/detail/CVE-2021-31811
Other 20
- [announce] 20210612 CVE-2021-31811: Apache PDFBox: A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading a tiny file
- [ofbiz-notifications] 20210613 [jira] [Updated] (OFBIZ-12256) Update PDFBox to 2.0.24 because of CVE-2021-31811 & CVE-2021-31812
- [ofbiz-notifications] 20210613 [jira] [Closed] (OFBIZ-12256) Update PDFBox to 2.0.24 because of CVE-2021-31811 & CVE-2021-31812
- [ofbiz-commits] 20210613 [ofbiz-framework] branch release17.12 updated: Fixed: Update PDFBox to 2.0.24 because of CVE-2021-31811 & CVE-2021-31812 (OFBIZ-12256)
- [ofbiz-commits] 20210613 [ofbiz-framework] branch trunk updated: Fixed: Update PDFBox to 2.0.24 because of CVE-2021-31811 & CVE-2021-31812 (OFBIZ-12256)
- [ofbiz-notifications] 20210613 [jira] [Created] (OFBIZ-12256) Update PDFBox to 2.0.24 because of CVE-2021-31811 & CVE-2021-31812
- [ofbiz-notifications] 20210613 [jira] [Commented] (OFBIZ-12256) Update PDFBox to 2.0.24 because of CVE-2021-31811 & CVE-2021-31812
- [ofbiz-commits] 20210613 [ofbiz-framework] branch release18.12 updated: Fixed: Update PDFBox to 2.0.24 because of CVE-2021-31811 & CVE-2021-31812 (OFBIZ-12256)
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://lists.fedoraproject.org/archives/list/[email protected]/message/MDJKJQOMVFDFIDS27OQJXNOYHV2O273D
- https://lists.fedoraproject.org/archives/list/[email protected]/message/7HHWJRFXZ3PTKLJCOM7WJEYZFKFWMNSV
- https://lists.apache.org/thread.html/rfe26bcaba564deb505c32711ba68df7ec589797dcd96ff3389a8aaba@%3Cnotifications.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/rf937c2236e6c79cdb99f76a70690dd345e53dbe0707cb506a202e43e@%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/re3bd16f0cc8f1fbda46b06a4b8241cd417f71402809baa81548fc20e@%3Cusers.pdfbox.apache.org%3E
- https://lists.apache.org/thread.html/re0cacd3fb337cdf8469853913ed2b4ddd8f8bfc52ff0ddbe61c1dfba@%3Ccommits.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/rd4b6db6c3b8ab3c70f1c3bbd725a40920896453ffc2744ade6afd9fb@%3Cnotifications.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r2090789e4dcc2c87aacbd87d5f18e2d64dcb9f6eb7c47f5cf7d293cb@%3Cnotifications.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r179cc3b6822c167702ab35fe36093d5da4c99af44238c8a754c6860f@%3Ccommits.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r143fd8445e0e778f4a85187bd79438630b96b8040e9401751fdb8aea@%3Ccommits.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r132e9dbbe0ebdc08b39583d8be0a575fdba573d60a42d940228bceff@%3Cnotifications.ofbiz.apache.org%3E
More Apache Pdfbox vulnerabilities
- TI-2019-00201 XML external entity injection in Apache PDFBox CVSS 3.1CRITICAL 9.8
- TI-2016-01985 Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML… CVSS 3.0HIGH 7.8
- TI-2018-05813 Infinite loop in Apache PDFBox CVSS 3.0MEDIUM 6.5
- TI-2021-09241 A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file CVSS 3.1MEDIUM 5.5
- TI-2018-08451 Uncontrolled resource consumption in Apache PDFBox CVSS 3.1MEDIUM 5.5
- TI-2021-11809 A carefully crafted PDF file can trigger an infinite loop while loading the file CVSS 3.1MEDIUM 5.5
Sources
- CVE-2021-31811 · CVE Program
- CVE-2021-31811 · NVD
- FIRST EPSS
- GHSA-fg3j-q579-v8x4 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-31811 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences