A carefully crafted PDF file can trigger an infinite loop while loading the file
Priority LOW 30CWE-834Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 1 fixed, 7 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-835.
Summary
In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
Why it matters now
EPSS 0.03054 87th percentileScored 2026-11-07
Fix Partial Apache PDFBox (Apache Software Foundation): 2.0.24org.apache.pdfbox:pdfbox (Maven): 2.0.24+1 more productRed Hat: 1 advisoryRed Hat: 1 fixed, 7 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache PDFBox | Apache PDFBox to before 2.0.24 | 2.0.24 | Patch available | CNA |
| — | org.apache.pdfbox:pdfbox (Maven) | 2.0.0 to before 2.0.24 | 2.0.24 | Patch available | GHSA-7grw-6pjh-jpc9 |
| — | org.apache.pdfbox:pdfbox-parent (Maven) | 2.0.0 to before 2.0.24 | 2.0.24 | Patch available | GHSA-7grw-6pjh-jpc9 |
- Apache PDFBox VendorApache Affected Apache PDFBox to before 2.0.24 Fixed in 2.0.24 Patch available CNA
- org.apache.pdfbox:pdfbox (Maven) Vendor— Affected 2.0.0 to before 2.0.24 Fixed in 2.0.24 Patch available GHSA-7grw-6pjh-jpc9
- org.apache.pdfbox:pdfbox-parent (Maven) Vendor— Affected 2.0.0 to before 2.0.24 Fixed in 2.0.24 Patch available GHSA-7grw-6pjh-jpc9
CPE configurations NVD · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:pdfbox:*:*:*:*:*:*:*:* | 2.0.0 – 2.0.23 | Vulnerable | Apache |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:* | 14.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:* | 14.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:* | 14.5.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:* | 14.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:* | 14.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:* | 14.5.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:*:*:*:*:*:*:* | 14.2.0 | Vulnerable | Oracle |
- cpe:2.3:a:apache:pdfbox:*:*:*:*:*:*:*:* Versions 2.0.0 – 2.0.23 Vulnerable ·Apache
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
Show 4 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:banking_supply_chain_finance:14.3.0:*:*:*:*:*:*:* | 14.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_supply_chain_finance:14.5.0:*:*:*:*:*:*:* | 14.5.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:18.1:*:*:*:*:*:*:* | 18.1 | Vulnerable | Oracle |
| cpe:2.3:o:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:* | 8.1 | Vulnerable | Oracle |
- cpe:2.3:a:oracle:banking_supply_chain_finance:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_supply_chain_finance:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:18.1:*:*:*:*:*:*:* Versions 18.1 Vulnerable ·Oracle
- cpe:2.3:o:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Oracle
Remediation
- Fix · CNA Apache PDFBox (Apache Software Foundation) Fixed in 2.0.24
- Fix · GHSA-7grw-6pjh-jpc9 org.apache.pdfbox:pdfbox (Maven) Fixed in 2.0.24 Advisory →
- Fix · GHSA-7grw-6pjh-jpc9 org.apache.pdfbox:pdfbox-parent (Maven) Fixed in 2.0.24 Advisory →
Red Hat 1 advisory
- RHSA-2021:4918 Released 2021-12-02 · Red Hat rating ModerateRed Hat Integration Camel-K 1.6 release and security update
- Red Hat Integration
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Apache PDFBox — FEDORA-2021-4a9ead5fff
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2021-11808 A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading a tiny filePriority LOW 31
- Advisory ·
Apache PDFBox — FEDORA-2021-3d94c14be4
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2021-11808 A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading a tiny filePriority LOW 31
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat BPM Suite 6 | Affected | No fix planned: Out of support scope |
| Red Hat Fuse 7 | Affected | No fix yet: Fix deferred |
| Red Hat Integration Camel K 1 | Affected | No fix yet |
| Red Hat JBoss BRMS 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat Integration | Fixed | RHSA-2021:4918 |
Timeline
- 2026-10-02 Threatist record created from CVE-2021-31812
- 2026-10-03 Alias added: GHSA-7grw-6pjh-jpc9
References
Patch 3
Advisory 5
- https://lists.apache.org/thread.html/ra2ab0ce69ce8aaff0773b8c1036438387ce004c2afc6f066626e205e%40%3Cusers.pdfbox.apache.org%3E
- [oss-security] 20210612 CVE-2021-31812: Apache PDFBox: A carefully crafted PDF file can trigger an infinite loop while loading the file
- FEDORA-2021-4a9ead5fff
- FEDORA-2021-3d94c14be4
- https://nvd.nist.gov/vuln/detail/CVE-2021-31812
Other 20
- [announce] 20210612 CVE-2021-31812: Apache PDFBox: A carefully crafted PDF file can trigger an infinite loop while loading the file
- [ofbiz-notifications] 20210613 [jira] [Updated] (OFBIZ-12256) Update PDFBox to 2.0.24 because of CVE-2021-31811 & CVE-2021-31812
- [ofbiz-notifications] 20210613 [jira] [Closed] (OFBIZ-12256) Update PDFBox to 2.0.24 because of CVE-2021-31811 & CVE-2021-31812
- [ofbiz-commits] 20210613 [ofbiz-framework] branch release17.12 updated: Fixed: Update PDFBox to 2.0.24 because of CVE-2021-31811 & CVE-2021-31812 (OFBIZ-12256)
- [ofbiz-commits] 20210613 [ofbiz-framework] branch trunk updated: Fixed: Update PDFBox to 2.0.24 because of CVE-2021-31811 & CVE-2021-31812 (OFBIZ-12256)
- [ofbiz-notifications] 20210613 [jira] [Created] (OFBIZ-12256) Update PDFBox to 2.0.24 because of CVE-2021-31811 & CVE-2021-31812
- [ofbiz-notifications] 20210613 [jira] [Commented] (OFBIZ-12256) Update PDFBox to 2.0.24 because of CVE-2021-31811 & CVE-2021-31812
- [ofbiz-commits] 20210613 [ofbiz-framework] branch release18.12 updated: Fixed: Update PDFBox to 2.0.24 because of CVE-2021-31811 & CVE-2021-31812 (OFBIZ-12256)
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://lists.fedoraproject.org/archives/list/[email protected]/message/MDJKJQOMVFDFIDS27OQJXNOYHV2O273D
- https://lists.fedoraproject.org/archives/list/[email protected]/message/7HHWJRFXZ3PTKLJCOM7WJEYZFKFWMNSV
- https://lists.apache.org/thread.html/rfe26bcaba564deb505c32711ba68df7ec589797dcd96ff3389a8aaba@%3Cnotifications.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/rf251f6c358087107f8c23473468b279d59d50a75db6b4768165c78d3@%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/re0cacd3fb337cdf8469853913ed2b4ddd8f8bfc52ff0ddbe61c1dfba@%3Ccommits.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/rd4b6db6c3b8ab3c70f1c3bbd725a40920896453ffc2744ade6afd9fb@%3Cnotifications.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/ra2ab0ce69ce8aaff0773b8c1036438387ce004c2afc6f066626e205e@%3Cusers.pdfbox.apache.org%3E
- https://lists.apache.org/thread.html/r2090789e4dcc2c87aacbd87d5f18e2d64dcb9f6eb7c47f5cf7d293cb@%3Cnotifications.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r179cc3b6822c167702ab35fe36093d5da4c99af44238c8a754c6860f@%3Ccommits.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r143fd8445e0e778f4a85187bd79438630b96b8040e9401751fdb8aea@%3Ccommits.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r132e9dbbe0ebdc08b39583d8be0a575fdba573d60a42d940228bceff@%3Cnotifications.ofbiz.apache.org%3E
More Apache Pdfbox vulnerabilities
- TI-2019-00201 XML external entity injection in Apache PDFBox CVSS 3.1CRITICAL 9.8
- TI-2016-01985 Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML… CVSS 3.0HIGH 7.8
- TI-2018-05813 Infinite loop in Apache PDFBox CVSS 3.0MEDIUM 6.5
- TI-2021-11808 A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading a tiny file CVSS 3.1MEDIUM 5.5
- TI-2021-09241 A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file CVSS 3.1MEDIUM 5.5
- TI-2018-08451 Uncontrolled resource consumption in Apache PDFBox CVSS 3.1MEDIUM 5.5
Sources
- CVE-2021-31812 · CVE Program
- CVE-2021-31812 · NVD
- FIRST EPSS
- GHSA-7grw-6pjh-jpc9 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-31812 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences