This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/pdfbox-docs.git
The following commit(s) were added to refs/heads/master by this push:
new fbf1827a PDFBOX-6208: add CVE table to /security
fbf1827a is described below
commit fbf1827a12a3f1198dbe3035b495661d767da6f6
Author: Maruan Sahyoun <[email protected]>
AuthorDate: Thu May 28 21:25:18 2026 +0200
PDFBOX-6208: add CVE table to /security
---
content/security.md | 20 +++++++++++++++++---
1 file changed, 17 insertions(+), 3 deletions(-)
diff --git a/content/security.md b/content/security.md
index 472c6c18..f7593fdd 100644
--- a/content/security.md
+++ b/content/security.md
@@ -26,8 +26,8 @@ title: Security
Processing untrusted PDFs is only supported to a point: malformed PDFs
will not cause remote code execution or other privilege escalation
-problems. However, processing them they may cause unchecked exceptions
-such as `StackOverflowException` or `NullPointerException`, or even use
+problems. However, processing them may cause unchecked exceptions
+such as `StackOverflowError` or `NullPointerException`, or even use
unexpected amounts of memory or cpu usage, including exhaustion of these.
## Reporting security issues
@@ -46,8 +46,22 @@ An overview of the vulnerability handling process is:
* The reporter reports the vulnerability privately to
[[email protected]]([email protected]).
* The PDFBox security team works privately with the reporter to resolve the
vulnerability.
-* The PDFBox project creates a new release of the package the vulnerabilty
affects to deliver its fix.
+* The PDFBox project creates a new release of the package the vulnerability
affects to deliver its fix.
* The PDFBox project publicly announces the vulnerability and describes how to
apply the fix.
Committers should read [a more detailed description of the
process](https://www.apache.org/security/committers.html). Reporters of
security vulnerabilities may also find it useful
+## Known vulnerabilities
+
+| CVE | Summary | Affected versions | Fixed in |
+|-----|---------|-------------------|----------|
+| CVE-2021-31811 | OutOfMemory loading a crafted PDF | ≤ 2.0.23 | 2.0.24 |
+| CVE-2021-31812 | Infinite loop loading a crafted PDF | ≤ 2.0.23 | 2.0.24 |
+| CVE-2021-27807 | Infinite loop loading a crafted PDF | ≤ 2.0.22 | 2.0.23 |
+| CVE-2021-27906 | OutOfMemory loading a crafted PDF | ≤ 2.0.22 | 2.0.23 |
+| CVE-2019-0228 | XML External Entity vulnerability | 2.0.14 only | 2.0.15 |
+| CVE-2018-11797 | DoS in parser | 1.8.0–1.8.15, 2.0.0RC1–2.0.11 | 1.8.16 /
2.0.12 |
+| CVE-2018-8036 | DoS (OOM) in AFMParser | 1.8.0–1.8.14, 2.0.0RC1–2.0.10 |
1.8.15 / 2.0.11 |
+| CVE-2016-2175 | XML External Entity vulnerability | 1.8.0–1.8.11, 2.0.0 |
1.8.12 / 2.0.1 |
+
+
