{"id":"CVE-2018-8036","aliases":["DEBIAN-CVE-2018-8036","EUVD-2022-4264","GHSA-j2xq-pfff-mvgg","SUSE-SU-2018:2630-1","SUSE-SU-2018:3318-1","UBUNTU-CVE-2018-8036","openSUSE-SU-2024:10622-1"],"status":"published","title":"Loop with Unreachable Exit Condition in Apache PDFBox","description":"In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03992,"percentile":0.90585,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-835"],"published":"2018-07-03T20:00:00Z","modified":"2026-10-24T10:30:29Z","fixes":[{"ecosystem":"Maven","package":"org.apache.pdfbox:pdfbox","fixed_in":["1.8.15","2.0.11"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"libpdfbox-java","fixed_in":["1:1.8.15-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libpdfbox-java","fixed_in":["1:1.8.15-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libpdfbox-java","fixed_in":["1:1.8.15-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libpdfbox2-java","fixed_in":["2.0.11-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libpdfbox2-java","fixed_in":["2.0.11-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libpdfbox2-java","fixed_in":["2.0.11-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15","package":"apache-pdfbox","fixed_in":["1.8.12-5.3.13"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libpdfbox-java","fixed_in":["1:1.8.16-2~18.04"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libpdfbox2-java","fixed_in":["2.0.13-2~18.04"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.pdfbox:pdfbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.0"},{"last_affected":"1.8.14"},{"fixed":"1.8.15"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.pdfbox:pdfbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0RC1"},{"last_affected":"2.0.10"},{"fixed":"2.0.11"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.15-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.15-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.15-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libpdfbox2-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.11-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libpdfbox2-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.11-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libpdfbox2-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.11-1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.pdfbox:pdfbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.0"},{"fixed":"1.8.15"}]}],"versions":["1.8.0","1.8.1","1.8.10","1.8.11","1.8.12","1.8.13","1.8.14","1.8.2","1.8.3","1.8.4","1.8.5","1.8.6","1.8.7","1.8.8","1.8.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.pdfbox:pdfbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0RC1"},{"fixed":"2.0.11"}]}],"versions":["2.0.0","2.0.0-RC1","2.0.0-RC2","2.0.0-RC3","2.0.1","2.0.10","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15","package":"apache-pdfbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.12-5.3.13"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"apache-pdfbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.12-3.5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.8.7+dfsg-1","1:1.8.10-1","1:1.8.10-2","1:1.8.11+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.16-2~18.04"}]}],"versions":["1:1.8.13-1","1:1.8.13-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libpdfbox2-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.13-2~18.04"}]}],"versions":["2.0.7-1","2.0.8-1","2.0.8-2","2.0.9-1"]}],"products":[{"vendor":"apache","product":"pdfbox"},{"vendor":"apache software foundation","product":"apache pdfbox"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2018:2669","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/9f62f742fd4fcd81654a9533b8a71349b064250840592bcd502dcfb6%40%3Cusers.pdfbox.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POPOGHJ5CVMUVCRQU7APBAN5IVZGZFDX/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HKVPTJWZGUB4MH4AAOWMRJHRDBYFHGJ/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r43491b25b2e5c368c34b106a82eff910a5cea3e90de82ad75cc16540%40%3Cdev.syncope.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-8036","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/9f62f742fd4fcd81654a9533b8a71349b064250840592bcd502dcfb6@%3Cusers.pdfbox.apache.org%3E","tags":["web","report"]},{"url":"https://lists.apache.org/thread.html/r43491b25b2e5c368c34b106a82eff910a5cea3e90de82ad75cc16540@%3Cdev.syncope.apache.org%3E","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6HKVPTJWZGUB4MH4AAOWMRJHRDBYFHGJ/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/POPOGHJ5CVMUVCRQU7APBAN5IVZGZFDX/"},{"url":"https://github.com/advisories/GHSA-j2xq-pfff-mvgg"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-8036","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6HKVPTJWZGUB4MH4AAOWMRJHRDBYFHGJ","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/POPOGHJ5CVMUVCRQU7APBAN5IVZGZFDX","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182630-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1099721","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8036","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183318-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1111009","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11797","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-8036","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2018/06/29/2","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-8036","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-27807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-27906","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-8036","description":"In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.","status":"published","published":"2018-07-03T20:00:00Z","modified":"2024-09-16T18:28:45.288Z","updated_at":"2026-11-02T14:35:04.540365Z"}],"euvd":[{"id":"EUVD-2022-4264","description":"In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.","status":"published","published":"2018-07-03T20:00:00Z","modified":"2024-09-16T18:28:45Z","updated_at":"2026-11-03T00:55:32.504958Z"}],"ghsa":[{"id":"GHSA-j2xq-pfff-mvgg","title":"Loop with Unreachable Exit Condition in Apache PDFBox","description":"In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.","status":"published","published":"2022-05-13T01:53:29Z","modified":"2023-01-27T05:02:17Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:36:17.742171Z"}],"nvd":[{"id":"CVE-2018-8036","description":"In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.","status":"published","published":"2018-07-03T20:29:00.247Z","modified":"2026-06-17T02:04:08.763Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:04:30.900603Z"}],"osv":[{"id":"CVE-2018-8036","description":"In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.","status":"published","published":"2018-07-03T20:29:00.247Z","modified":"2026-10-24T10:30:29.476548017Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:09.74357Z"},{"id":"DEBIAN-CVE-2018-8036","description":"In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.","status":"published","published":"2018-07-03T20:29:00.247Z","modified":"2026-10-23T18:03:48.372635853Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:31.170944Z"},{"id":"GHSA-j2xq-pfff-mvgg","title":"Loop with Unreachable Exit Condition in Apache PDFBox","description":"In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.","status":"published","published":"2022-05-13T01:53:29Z","modified":"2024-02-20T05:34:40.059516Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:46:49.977351Z"},{"id":"UBUNTU-CVE-2018-8036","description":"In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.","status":"published","published":"2018-07-03T20:29:00Z","modified":"2025-10-24T04:46:57Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:18.772093Z"},{"id":"openSUSE-SU-2024:10622-1","title":"apache-pdfbox-2.0.23-1.3 on GA media","description":"These are all security issues fixed in the apache-pdfbox-2.0.23-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:50:36.965582Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2018:2630-1","title":"Security update for apache-pdfbox","description":"This update for apache-pdfbox fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2018-8036: Fix infinite loop while parsing files that leads to an out of memory issue (bsc#1099721).\n","status":"published","published":"2018-09-06T05:36:21Z","modified":"2026-02-04T03:57:01.559749Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:3318-1","title":"Security update for apache-pdfbox","description":"This update for apache-pdfbox fixes the following security issue:\n\n- CVE-2018-8036: A crafted file could have triggered an infinite loop which lead to DoS (bsc#1099721).\n- CVE-2018-11797: A carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree. (bsc#1111009):\n","status":"published","published":"2018-10-23T09:13:37Z","modified":"2026-02-04T02:38:45.719508Z","updated_at":"2026-11-02T15:53:45.378228Z"}]}}