Read the docs
TI-2022-08123 Aliases CVE-2022-24196GHSA-hhh6-cm2m-3fhc

iText v7.1.17, up to (exluding)": 7.1.18 and 7.2.2 was discovered to contain an…

Priority LOW 32CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

iText v7.1.17, up to (exluding)": 7.1.18 and 7.2.2 was discovered to contain an out-of-memory error via the component readStreamBytesRaw, which allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.

Why it matters now

EPSS 0.0139 72nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed com.itextpdf:itext7-core (Maven): 7.1.18

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—com.itextpdf:itext7-core (Maven)before 7.1.187.1.18Patch availableGHSA-hhh6-cm2m-3fhc
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • com.itextpdf:itext7-core (Maven) Vendor— Affected before 7.1.18 Fixed in 7.1.18 Patch available GHSA-hhh6-cm2m-3fhc

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:itextpdf:itext:*:*:*:*:*:*:*:*before 7.2.2VulnerableItextpdf
  • cpe:2.3:a:itextpdf:itext:*:*:*:*:*:*:*:* Versions before 7.2.2 Vulnerable ·Itextpdf

Remediation

  • Fix · GHSA-hhh6-cm2m-3fhc com.itextpdf:itext7-core (Maven) Fixed in 7.1.18 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-24196
  2. 2026-10-03 Alias added: GHSA-hhh6-cm2m-3fhc

References

Exploit 1

Advisory 2

Other 2

  • TI-2021-19160 iTextPDF in iText 7 and up to (excluding 4.4.13.3) 7.1.17 allows command injection via a… CVSS 3.1CRITICAL 9.8
  • TI-2017-06550 The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external… CVSS 3.0HIGH 8.8
  • TI-2023-05782 Apryse iText Reference Table PdfDocument.java memory leak CVSS 3.1MEDIUM 6.5
  • TI-2023-05781 Apryse iText PdfDocument.java main array index CVSS 3.1MEDIUM 6.5
  • TI-2022-08124 iText v7.1.17 was discovered to contain a stack-based buffer overflow via the component… CVSS 3.1MEDIUM 6.5
  • TI-2022-08125 iText v7.1.17 was discovered to contain an out-of-bounds exception via the component… CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences