Every CVE Search/ Get API key

CVE-2024-22640

TCPDF vulnerable to Regular Expression Denial of Service

7.5 HighPublic exploitFix available

CVE-2024-22640 is a high vulnerability (CVSS 7.5) in Tcpdf Project Tcpdf, published April 19, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.32%, the 70th percentile. Fixed in tecnickcom/tcpdf 6.7.5.

TCPDF version <=6.6.5 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.32%Up 1.3 points since Apr 20, 2024
90%50%10%1%

What each source reports

CVE List Score used 7.5

TCPDF version <=6.6.5 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color.

Record
CVE-2024-22640
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333
Updated
2026-11-02
EUVDEUVD-2024-1258 7.5

TCPDF version <=6.6.5 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color.

Record
EUVD-2024-1258
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-mx3p-fhpw-x6rv 5.1

TCPDF vulnerable to Regular Expression Denial of Service

TCPDF version <= 6.7.4 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color.

Record
GHSA-mx3p-fhpw-x6rv
CVSS 4.0
5.1 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-1333
Updated
2026-11-02
NVD 7.5

TCPDF version <=6.6.5 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color.

Record
CVE-2024-22640
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333
Updated
2026-11-02
OSV 7.5

TCPDF version <=6.6.5 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color.

Record
CVE-2024-22640
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2024-22640 7.5

TCPDF version <=6.6.5 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color.

Record
DEBIAN-CVE-2024-22640
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVGHSA-mx3p-fhpw-x6rv 5.1

TCPDF vulnerable to Regular Expression Denial of Service

TCPDF version <= 6.7.4 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color.

Record
GHSA-mx3p-fhpw-x6rv
CVSS 4.0
5.1 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-1333
Updated
2026-11-02
OSVUBUNTU-CVE-2024-22640 7.5

TCPDF version <=6.6.5 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color.

Record
UBUNTU-CVE-2024-22640
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2024-0169 No score

Updated php-tcpdf packages fix security vulnerability

TCPDF version <=6.6.5 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color. (CVE-2024-22640)

Record
MGASA-2024-0169
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
tecnickcom/tcpdf
Packagist
 through 6.7.4
6.7.5
tcpdf
Debian:12
 before 6.6.2+dfsg1-1+deb12u1, plus listed versions
6.6.2+dfsg1-1
6.6.2+dfsg1-1+deb12u1
tcpdf
Debian:13
 before 6.7.5+dfsg-1
6.7.5+dfsg-1
tcpdf
Debian:14
 before 6.7.5+dfsg-1
6.7.5+dfsg-1
tcpdf
Debian:11
 before 6.3.5+dfsg1-1+deb11u1, plus listed versions
6.3.5+dfsg1-1
6.3.5+dfsg1-1+deb11u1
tecnickcom/tcpdf
Packagist
 before 6.7.5, plus listed versions
6.0.0136.0.0146.0.0156.0.0166.0.017
Show 45 moreShow less
6.0.0186.0.0196.0.0206.0.0216.0.0226.0.0236.0.0246.0.0256.0.0266.0.0276.0.0286.0.0296.0.0306.0.0316.0.0326.0.0336.0.0346.0.0356.0.0366.0.0376.0.0386.0.0396.0.0406.0.0416.0.0426.0.0436.0.0446.0.0456.0.0466.0.0476.0.0486.0.0496.0.0506.0.0516.0.0526.0.0536.0.0546.0.0556.0.0566.0.0576.0.0586.0.0596.0.0606.0.0616.0.062
6.7.5
php-tcpdf
Mageia:9
 before 6.5.0-1.1.mga9
6.5.0-1.1.mga9
tcpdf
Ubuntu:14.04:LTS
 All versions, plus listed versions
6.0.010+dfsg-16.0.021+dfsg-16.0.048+dfsg-16.0.048+dfsg-2
 None known
tcpdf
Ubuntu:16.04:LTS
 All versions, plus listed versions
6.0.093+dfsg-16.0.093+dfsg-1ubuntu1
 None known
tcpdf
Ubuntu:18.04:LTS
 All versions, plus listed versions
6.2.12+dfsg2-1ubuntu16.2.13+dfsg-16.2.13+dfsg-1ubuntu1
 None known
Show 6 moreShow less
Affected packages
PackageAffectedFixed
tcpdf
Ubuntu:20.04:LTS
 All versions, plus listed versions
6.2.13+dfsg-1ubuntu16.3.2+dfsg1-16.3.4+dfsg1-16.3.5+dfsg1-1
 None known
tcpdf
Ubuntu:22.04:LTS
 All versions, plus listed versions
6.3.5+dfsg1-16.4.2+dfsg1-16.4.4+dfsg1-1
 None known
tcpdf
Ubuntu:24.04:LTS
 All versions, plus listed versions
6.6.2+dfsg1-16.6.5+dfsg-16.7.4+dfsg-16.7.5+dfsg-1
 None known
tcpdf
Ubuntu:25.10
 All versions, plus listed versions
6.8.2+dfsg-16.9.1+dfsg-1
 None known
tcpdf
Ubuntu:26.10
 All versions, plus listed versions
6.11.2+dfsg-2
 None known
tcpdf
Ubuntu:26.04:LTS
 All versions, plus listed versions
6.9.1+dfsg-16.10.1+dfsg-16.10.1+dfsg-26.10.1+dfsg-2ubuntu16.10.1+dfsg-2ubuntu26.11.2+dfsg-2
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubzunak/CVE-2024-226402024-04-01

History

History
WhenChangedSources
2026-11-02createdCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

References

Show 9 moreShow less
This page doesn't list everything

Left out here: 77 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open