Description
In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache PDFBox | Apache PDFBox – < 2.0.24 | 2.0.24 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libpdfbox-java | No fix yet | — |
| Debian 14 | libpdfbox2-java | 2.0.24-1 | — |
| Debian 13 | libpdfbox-java | No fix yet | — |
| Debian 13 | libpdfbox2-java | 2.0.24-1 | — |
| Debian 12 | libpdfbox-java | No fix yet | — |
| Debian 12 | libpdfbox2-java | 2.0.24-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | libpdfbox-java +1 | No fix yet | — |
| Ubuntu 26.04 LTS | libpdfbox-java +1 | No fix yet | — |
| Ubuntu 25.10 | libpdfbox-java +1 | No fix yet | — |
| Ubuntu 24.04 LTS | libpdfbox-java +1 | No fix yet | — |
| Ubuntu 22.04 LTS | libpdfbox-java +1 | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | libpdfbox-java +1 | No fix yet | — |
| Ubuntu 18.04 LTS | libpdfbox-java +1 | No fix yet | — |
| Ubuntu 16.04 LTS | libpdfbox-java | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.pdfbox:pdfbox | >= 2.0.0, < 2.0.24 | 2.0.24 | GHSA-fg3j-q579-v8x4 |
| Maven | org.apache.pdfbox:pdfbox-parent | >= 2.0.0, < 2.0.24 | 2.0.24 | GHSA-fg3j-q579-v8x4 |
Advisories 2
- WID-SEC-2025-0227 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- WID-SEC-2024-0156 IBM Business Automation Workflow: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 17, 2024
References
- https://lists.apache.org/thread.html/re3bd16f0cc8f1fbda46b06a4b8241cd417f71402809baa81548fc20e%40%3Cusers.pdfbox.apache.org%3E
- [announce] 20210612 CVE-2021-31811: Apache PDFBox: A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading a tiny file mailing-list
- [oss-security] 20210612 CVE-2021-31811: Apache PDFBox: A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading a tiny file mailing-list
- [ofbiz-notifications] 20210613 [jira] [Updated] (OFBIZ-12256) Update PDFBox to 2.0.24 because of CVE-2021-31811 & CVE-2021-31812 mailing-list
- [ofbiz-notifications] 20210613 [jira] [Closed] (OFBIZ-12256) Update PDFBox to 2.0.24 because of CVE-2021-31811 & CVE-2021-31812 mailing-list
- [ofbiz-commits] 20210613 [ofbiz-framework] branch release17.12 updated: Fixed: Update PDFBox to 2.0.24 because of CVE-2021-31811 & CVE-2021-31812 (OFBIZ-12256) mailing-list
- [ofbiz-commits] 20210613 [ofbiz-framework] branch trunk updated: Fixed: Update PDFBox to 2.0.24 because of CVE-2021-31811 & CVE-2021-31812 (OFBIZ-12256) mailing-list
- [ofbiz-notifications] 20210613 [jira] [Created] (OFBIZ-12256) Update PDFBox to 2.0.24 because of CVE-2021-31811 & CVE-2021-31812 mailing-list
- [ofbiz-notifications] 20210613 [jira] [Commented] (OFBIZ-12256) Update PDFBox to 2.0.24 because of CVE-2021-31811 & CVE-2021-31812 mailing-list
- [ofbiz-commits] 20210613 [ofbiz-framework] branch release18.12 updated: Fixed: Update PDFBox to 2.0.24 because of CVE-2021-31811 & CVE-2021-31812 (OFBIZ-12256) mailing-list
- FEDORA-2021-4a9ead5fff vendor-advisory
- FEDORA-2021-3d94c14be4 vendor-advisory
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html