CVE-2021-27807
A carefully crafted PDF file can trigger an infinite loop while loading the file
A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
- Record
CVE-2021-27807- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-834
- Updated
- 2026-11-02
CVE List No score
A carefully crafted PDF file can trigger an infinite loop while loading the file
A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
- Record
CVE-2021-27807- Weakness
- CWE-834
- Updated
- 2026-11-02
EUVDEUVD-2021-1242
A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
- Record
EUVD-2021-1242- CVSS
- 0.0 None
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2h3j-m7gr-25xj
Excessive Iteration Denial of Service in Apache PDFBox
A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
- Record
GHSA-2h3j-m7gr-25xj- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-834
- Updated
- 2026-11-02
OSV
A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
- Record
CVE-2021-27807- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-27807
A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
- Record
DEBIAN-CVE-2021-27807- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVGHSA-2h3j-m7gr-25xj
Excessive Iteration Denial of Service in Apache PDFBox
A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
- Record
GHSA-2h3j-m7gr-25xj- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-834
- Updated
- 2026-11-02
OSVOESA-2021-1160
pdfbox security update
Apache PDFBox is an open source Java PDF library for working with PDF documents. This project allows creation of new PDF documents, manipulation of existing documents and the ability to extract content from documents. Apache PDFBox also includes several command line utilities. Apache PDFBox is published under the Apache License v2.0.
Security Fix(es):
A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.(CVE-2021-27807)
A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.(CVE-2021-27906)
- Record
OESA-2021-1160- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHLW-2026-4f7c55b876854238
Lightwell Security Advisory: fontbox 2.0.19.rhlw-00001
Red Hat Lightwell has released org.apache.pdfbox:fontbox 2.0.19.rhlw-00001 with a backported security fix.
CVE-2021-27807: A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
This patched artifact is a drop-in replacement for org.apache.pdfbox:fontbox 2.0.19 from Maven Central.
- Record
RHLW-2026-4f7c55b876854238- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHLW-2026-b2c64e34ae82b333
Lightwell Security Advisory: pdfbox 2.0.19.rhlw-00001
Red Hat Lightwell has released org.apache.pdfbox:pdfbox 2.0.19.rhlw-00001 with a backported security fix.
CVE-2021-27807: A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
This patched artifact is a drop-in replacement for org.apache.pdfbox:pdfbox 2.0.19 from Maven Central.
- Record
RHLW-2026-b2c64e34ae82b333- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-27807
A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
- Record
UBUNTU-CVE-2021-27807- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2021-0184 No score
Updated pdfbox packages fix security vulnerabilities
A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox Apache PDFBox version 2.0.22 and prior 2.0.x versions (CVE-2021-27807).
A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox Apache PDFBox version 2.0.22 and prior 2.0.x versions (CVE-2021-27906).
- Record
MGASA-2021-0184- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10622-1 No score
apache-pdfbox-2.0.23-1.3 on GA media
These are all security issues fixed in the apache-pdfbox-2.0.23-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10622-1- Updated
- 2026-11-02
Affected products
- apache pdfbox
- apache software foundation pdfbox
- fedoraproject fedora
- oracle banking trade finance process management
- oracle banking treasury management
- oracle banking virtual account management
- oracle communications messaging server
- oracle communications session report manager
- oracle flexcube universal banking
- oracle hyperion financial reporting
- oracle hyperion infrastructure technology
- oracle outside in technology
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.pdfbox:pdfboxMaven |
2.0.0 up to 2.0.23 | 2.0.23 |
libpdfbox2-javaDebian:12 |
before 2.0.23-1 | 2.0.23-1 |
libpdfbox2-javaDebian:13 |
before 2.0.23-1 | 2.0.23-1 |
libpdfbox2-javaDebian:14 |
before 2.0.23-1 | 2.0.23-1 |
org.apache.pdfbox:pdfboxMaven |
2.0.0 up to 2.0.23, plus listed versions 2.0.12.0.102.0.112.0.122.0.13 Show 17 moreShow less2.0.142.0.152.0.162.0.172.0.182.0.192.0.22.0.202.0.212.0.222.0.32.0.42.0.52.0.62.0.72.0.82.0.9 |
2.0.23 |
pdfboxMageia:8 From an advisory covering 2 CVEs |
before 2.0.23-1.mga8 | 2.0.23-1.mga8 |
pdfboxopenEuler:20.03-LTS-SP1 From an advisory covering 2 CVEs |
before 2.0.23-1.oe1 | 2.0.23-1.oe1 |
org.apache.pdfbox:fontboxRed Hat Lightwell:Maven |
before 2.0.19.rhlw-00001, plus listed versions 0.8.0-incubator1.0.01.1.01.2.01.2.1 Show 45 moreShow less1.3.11.4.01.5.01.6.01.7.01.7.11.8.01.8.11.8.101.8.111.8.121.8.131.8.141.8.151.8.161.8.171.8.21.8.31.8.41.8.51.8.61.8.71.8.81.8.92.0.02.0.0-RC12.0.0-RC22.0.0-RC32.0.12.0.102.0.112.0.122.0.132.0.142.0.152.0.162.0.172.0.182.0.192.0.22.0.32.0.42.0.52.0.62.0.7 |
2.0.19.rhlw-00001 |
org.apache.pdfbox:pdfboxRed Hat Lightwell:Maven |
before 2.0.19.rhlw-00001, plus listed versions 0.8.0-incubating0.8.0-incubator1.0.01.1.01.2.0 Show 45 moreShow less1.2.11.3.11.4.01.5.01.6.01.7.01.7.11.8.01.8.11.8.101.8.111.8.121.8.131.8.141.8.151.8.161.8.171.8.21.8.31.8.41.8.51.8.61.8.71.8.81.8.92.0.02.0.0-RC12.0.0-RC22.0.0-RC32.0.12.0.102.0.112.0.122.0.132.0.142.0.152.0.162.0.172.0.182.0.192.0.22.0.32.0.42.0.52.0.6 |
2.0.19.rhlw-00001 |
libpdfbox-javaUbuntu:16.04:LTS |
All versions, plus listed versions 1:1.8.7+dfsg-11:1.8.10-11:1.8.10-21:1.8.11+dfsg-1 |
None known |
Show 14 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libpdfbox-javaUbuntu:18.04:LTS |
All versions, plus listed versions 1:1.8.13-11:1.8.13-21:1.8.16-2~18.04 |
None known |
libpdfbox2-javaUbuntu:18.04:LTS |
All versions, plus listed versions 2.0.7-12.0.8-12.0.8-22.0.9-12.0.13-2~18.04 |
None known |
libpdfbox-javaUbuntu:20.04:LTS |
All versions, plus listed versions 1:1.8.16-2 |
None known |
libpdfbox2-javaUbuntu:20.04:LTS |
All versions, plus listed versions 2.0.16-12.0.17-12.0.18-1 |
None known |
libpdfbox-javaUbuntu:22.04:LTS |
All versions, plus listed versions 1:1.8.16-2 |
None known |
libpdfbox2-javaUbuntu:22.04:LTS |
All versions, plus listed versions 2.0.23-12.0.24-22.0.25-1 |
None known |
libpdfbox-javaUbuntu:24.04:LTS |
All versions, plus listed versions 1:1.8.16-41:1.8.16-5 |
None known |
libpdfbox2-javaUbuntu:24.04:LTS |
All versions, plus listed versions 2.0.27-22.0.29-1 |
None known |
libpdfbox-javaUbuntu:25.10 |
All versions, plus listed versions 1:1.8.16-5 |
None known |
libpdfbox2-javaUbuntu:25.10 |
All versions, plus listed versions 2.0.29-1 |
None known |
libpdfbox-javaUbuntu:26.10 |
All versions, plus listed versions 1:1.8.16-5 |
None known |
libpdfbox2-javaUbuntu:26.10 |
All versions, plus listed versions 2.0.29-1 |
None known |
libpdfbox-javaUbuntu:26.04:LTS |
All versions, plus listed versions 1:1.8.16-5 |
None known |
libpdfbox2-javaUbuntu:26.04:LTS |
All versions, plus listed versions 2.0.29-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-27807 is a medium vulnerability (CVSS 5.5) in Apache Pdfbox, published March 19, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.99%, the 87th percentile. Fixed in org.apache.pdfbox:pdfbox 2.0.23.
References
lists.apache.org/thread.html/r818058ff1e4b9f6bef4e5a2e74faff38cb3d3885c1e2db398bc55cfb%40%3Cusers.pdfbox.apache.org%3E
openwall.com/lists/oss-security/2021/03/19/9
Show 50 moreShow less
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PT72QOFDXLJ7PLTN66EMG5EHPTE7TFZ
oracle.com//security-alerts/cpujul2021.html
nvd.nist.gov/vuln/detail/CVE-2021-27807
github.com/apache/pdfbox/commit/5c5a837140fbb4ef78bb5ef9f29ad537c872c83e
issues.apache.org/jira/browse/PDFBOX-4892
svn.apache.org/viewvc?view=revision&revision=1886911
security-tracker.debian.org/tracker/CVE-2021-27807
advisories.mageia.org/MGASA-2021-0184.html
bugs.mageia.org/show_bug.cgi?id=28682
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1160
ubuntu.com/security/CVE-2021-27807
cve.org/CVERecord?id=CVE-2021-27807
suse.com/security/cve/CVE-2018-11797
Left out here: 5 versions. The JSON record has them.