Every CVE Search/ Get API key

CVE-2024-56521

TCPDF missing certificate validation

9.8 CriticalFix available

An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are set unsafely.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.78%Up 0.7 points since Dec 27, 2024
90%50%10%1%

What each source reports

CVE List Score used 9.8

An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are set unsafely.

Record
CVE-2024-56521
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-295
Updated
2026-11-02
EUVDEUVD-2024-3571 9.8

An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are set unsafely.

Record
EUVD-2024-3571
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-9mgx-552f-59p6 8.2

TCPDF missing certificate validation

An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are set unsafely.

Record
GHSA-9mgx-552f-59p6
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-295
Updated
2026-11-02
NVD 9.8

An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are set unsafely.

Record
CVE-2024-56521
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-295
Updated
2026-11-02
OSV 9.8

An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are set unsafely.

Record
CVE-2024-56521
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-295
Updated
2026-11-02
OSVDEBIAN-CVE-2024-56521 9.8

An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are set unsafely.

Record
DEBIAN-CVE-2024-56521
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-9mgx-552f-59p6 8.2

TCPDF missing certificate validation

An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are set unsafely.

Record
GHSA-9mgx-552f-59p6
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-295
Updated
2026-11-02
OSVUBUNTU-CVE-2024-56521 9.8

An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are set unsafely.

Record
UBUNTU-CVE-2024-56521
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2025-0059 No score

Updated php-tcpdf packages fix security vulnerabilities

An issue was discovered in TCPDF before 6.8.0. setSVGStyles does not sanitize the SVG font-family attribute. (CVE-2024-56519) An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are set unsafely. (CVE-2024-56521) An issue was discovered in TCPDF before 6.8.0. unserializeTCPDFtag uses != (aka loose comparison) and does not use a constant-time function to compare TCPDF tag hashes. (CVE-2024-56522) An issue was discovered in TCPDF before 6.8.0. The Error function lacks an htmlspecialchars call for the error message. (CVE-2024-56527)

Record
MGASA-2025-0059
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
tecnickcom/tcpdf
Packagist
 before 6.8.0
6.8.0
tcpdf
Debian:12
 All versions, plus listed versions
6.10.1+dfsg-16.10.1+dfsg-26.11.2+dfsg-16.11.2+dfsg-26.6.2+dfsg1-1
Show 12 moreShow less
6.6.2+dfsg1-1+deb12u16.6.3+dfsg1-16.6.5+dfsg-16.7.4+dfsg-16.7.5+dfsg-16.7.7+dfsg-16.8.0+dfsg-16.8.0+dfsg-1~bpo12+16.8.2+dfsg-16.8.2+dfsg-1~bpo12+16.9.1+dfsg-16.9.1+dfsg-1~bpo12+1
 None known
tcpdf
Debian:13
 before 6.8.0+dfsg-1
6.8.0+dfsg-1
tcpdf
Debian:14
 before 6.8.0+dfsg-1
6.8.0+dfsg-1
tecnickcom/tcpdf
Packagist
 before 6.8.0, plus listed versions
6.0.0136.0.0146.0.0156.0.0166.0.017
Show 45 moreShow less
6.0.0186.0.0196.0.0206.0.0216.0.0226.0.0236.0.0246.0.0256.0.0266.0.0276.0.0286.0.0296.0.0306.0.0316.0.0326.0.0336.0.0346.0.0356.0.0366.0.0376.0.0386.0.0396.0.0406.0.0416.0.0426.0.0436.0.0446.0.0456.0.0466.0.0476.0.0486.0.0496.0.0506.0.0516.0.0526.0.0536.0.0546.0.0556.0.0566.0.0576.0.0586.0.0596.0.0606.0.0616.0.062
6.8.0
php-tcpdf
Mageia:9
From an advisory covering 4 CVEs
 before 6.5.0-1.3.mga9
6.5.0-1.3.mga9
tcpdf
Ubuntu:14.04:LTS
 All versions, plus listed versions
6.0.010+dfsg-16.0.021+dfsg-16.0.048+dfsg-16.0.048+dfsg-2
 None known
tcpdf
Ubuntu:16.04:LTS
 All versions, plus listed versions
6.0.093+dfsg-16.0.093+dfsg-1ubuntu1
 None known
tcpdf
Ubuntu:18.04:LTS
 All versions, plus listed versions
6.2.12+dfsg2-1ubuntu16.2.13+dfsg-16.2.13+dfsg-1ubuntu1
 None known
tcpdf
Ubuntu:20.04:LTS
 All versions, plus listed versions
6.2.13+dfsg-1ubuntu16.3.2+dfsg1-16.3.4+dfsg1-16.3.5+dfsg1-1
 None known
tcpdf
Ubuntu:22.04:LTS
 All versions, plus listed versions
6.3.5+dfsg1-16.4.2+dfsg1-16.4.4+dfsg1-1
 None known
tcpdf
Ubuntu:24.04:LTS
 All versions, plus listed versions
6.6.2+dfsg1-16.6.5+dfsg-16.7.4+dfsg-16.7.5+dfsg-1
 None known

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-56521 is a critical vulnerability (CVSS 9.8) in Tcpdf Project Tcpdf, published December 27, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.78%, the 56th percentile. Fixed in tecnickcom/tcpdf 6.8.0.

References

Show 7 moreShow less
This page doesn't list everything

Left out here: 81 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open