{"id":"CVE-2021-31812","aliases":["DEBIAN-CVE-2021-31812","EUVD-2021-1279","GHSA-7grw-6pjh-jpc9","MGASA-2021-0378","OESA-2021-1256","UBUNTU-CVE-2021-31812"],"status":"published","title":"A carefully crafted PDF file can trigger an infinite loop while loading the file","description":"In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.03054,"percentile":0.87768,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-834","CWE-835"],"published":"2021-06-12T09:45:11Z","modified":"2026-10-24T10:30:24Z","fixes":[{"ecosystem":"Maven","package":"org.apache.pdfbox:pdfbox","fixed_in":["2.0.24"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.pdfbox:pdfbox-parent","fixed_in":["2.0.24"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"libpdfbox2-java","fixed_in":["2.0.24-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libpdfbox2-java","fixed_in":["2.0.24-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libpdfbox2-java","fixed_in":["2.0.24-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.pdfbox:pdfbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.24"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.pdfbox:pdfbox-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.24"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.8.16-2","1:1.8.16-3","1:1.8.16-4","1:1.8.16-5","1:1.8.17-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.8.16-5","1:1.8.17-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.8.16-5","1:1.8.17-1"]},{"source":"osv","ecosystem":"Debian:12","package":"libpdfbox2-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.24-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libpdfbox2-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.24-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libpdfbox2-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.24-1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.pdfbox:pdfbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.24"}]}],"versions":["2.0.0","2.0.1","2.0.10","2.0.11","2.0.12","2.0.13","2.0.14","2.0.15","2.0.16","2.0.17","2.0.18","2.0.19","2.0.2","2.0.20","2.0.21","2.0.22","2.0.23","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.pdfbox:pdfbox-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.24"}]}],"versions":["2.0.0","2.0.1","2.0.10","2.0.11","2.0.12","2.0.13","2.0.14","2.0.15","2.0.16","2.0.17","2.0.18","2.0.19","2.0.2","2.0.20","2.0.21","2.0.22","2.0.23","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9"]},{"source":"osv","ecosystem":"Mageia:8","package":"pdfbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.24-1.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"pdfbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.24-1.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.8.7+dfsg-1","1:1.8.10-1","1:1.8.10-2","1:1.8.11+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.8.13-1","1:1.8.13-2","1:1.8.16-2~18.04"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libpdfbox2-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.7-1","2.0.8-1","2.0.8-2","2.0.9-1","2.0.13-2~18.04"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.8.16-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libpdfbox2-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.16-1","2.0.17-1","2.0.18-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.8.16-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libpdfbox2-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.23-1","2.0.24-2","2.0.25-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.8.16-4","1:1.8.16-5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libpdfbox2-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.27-2","2.0.29-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.8.16-5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libpdfbox2-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.29-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.8.16-5"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libpdfbox2-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.29-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.8.16-5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libpdfbox2-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.29-1"]}],"products":[{"vendor":"apache","product":"pdfbox"},{"vendor":"apache software foundation","product":"apache pdfbox"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"oracle","product":"banking_corporate_lending_process_management"},{"vendor":"oracle","product":"banking_credit_facilities_process_management"},{"vendor":"oracle","product":"banking_supply_chain_finance"},{"vendor":"oracle","product":"communications_messaging_server"},{"vendor":"oracle","product":"retail_customer_management_and_segmentation_foundation"}],"references":[{"url":"https://lists.apache.org/thread.html/ra2ab0ce69ce8aaff0773b8c1036438387ce004c2afc6f066626e205e%40%3Cusers.pdfbox.apache.org%3E","tags":["x_refsource_MISC","mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Vendor Advisory","advisory","web","report"]},{"url":"https://lists.apache.org/thread.html/rf251f6c358087107f8c23473468b279d59d50a75db6b4768165c78d3%40%3Cannounce.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2021/06/12/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web","report"]},{"url":"https://lists.apache.org/thread.html/rfe26bcaba564deb505c32711ba68df7ec589797dcd96ff3389a8aaba%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rd4b6db6c3b8ab3c70f1c3bbd725a40920896453ffc2744ade6afd9fb%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r143fd8445e0e778f4a85187bd79438630b96b8040e9401751fdb8aea%40%3Ccommits.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r179cc3b6822c167702ab35fe36093d5da4c99af44238c8a754c6860f%40%3Ccommits.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r2090789e4dcc2c87aacbd87d5f18e2d64dcb9f6eb7c47f5cf7d293cb%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r132e9dbbe0ebdc08b39583d8be0a575fdba573d60a42d940228bceff%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/re0cacd3fb337cdf8469853913ed2b4ddd8f8bfc52ff0ddbe61c1dfba%40%3Ccommits.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7HHWJRFXZ3PTKLJCOM7WJEYZFKFWMNSV/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MDJKJQOMVFDFIDS27OQJXNOYHV2O273D/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-31812","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/r132e9dbbe0ebdc08b39583d8be0a575fdba573d60a42d940228bceff@%3Cnotifications.ofbiz.apache.org%3E","tags":["web","report"]},{"url":"https://lists.apache.org/thread.html/r143fd8445e0e778f4a85187bd79438630b96b8040e9401751fdb8aea@%3Ccommits.ofbiz.apache.org%3E","tags":["web","report"]},{"url":"https://lists.apache.org/thread.html/r179cc3b6822c167702ab35fe36093d5da4c99af44238c8a754c6860f@%3Ccommits.ofbiz.apache.org%3E","tags":["web","report"]},{"url":"https://lists.apache.org/thread.html/r2090789e4dcc2c87aacbd87d5f18e2d64dcb9f6eb7c47f5cf7d293cb@%3Cnotifications.ofbiz.apache.org%3E","tags":["web","report"]},{"url":"https://lists.apache.org/thread.html/ra2ab0ce69ce8aaff0773b8c1036438387ce004c2afc6f066626e205e@%3Cusers.pdfbox.apache.org%3E","tags":["web","report"]},{"url":"https://lists.apache.org/thread.html/rd4b6db6c3b8ab3c70f1c3bbd725a40920896453ffc2744ade6afd9fb@%3Cnotifications.ofbiz.apache.org%3E","tags":["web","report"]},{"url":"https://lists.apache.org/thread.html/re0cacd3fb337cdf8469853913ed2b4ddd8f8bfc52ff0ddbe61c1dfba@%3Ccommits.ofbiz.apache.org%3E","tags":["web","report"]},{"url":"https://lists.apache.org/thread.html/rf251f6c358087107f8c23473468b279d59d50a75db6b4768165c78d3@%3Cannounce.apache.org%3E","tags":["web","report"]},{"url":"https://lists.apache.org/thread.html/rfe26bcaba564deb505c32711ba68df7ec589797dcd96ff3389a8aaba@%3Cnotifications.ofbiz.apache.org%3E","tags":["web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7HHWJRFXZ3PTKLJCOM7WJEYZFKFWMNSV/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MDJKJQOMVFDFIDS27OQJXNOYHV2O273D/"},{"url":"https://github.com/advisories/GHSA-7grw-6pjh-jpc9"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-31812","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MDJKJQOMVFDFIDS27OQJXNOYHV2O273D","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7HHWJRFXZ3PTKLJCOM7WJEYZFKFWMNSV","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2021-0378.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29125","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/MDJKJQOMVFDFIDS27OQJXNOYHV2O273D/","tags":["web"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1256","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-31811","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-31812","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2021/06/12/1","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-31812","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-31812","title":"A carefully crafted PDF file can trigger an infinite loop while loading the file","description":"In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.","status":"published","published":"2021-06-12T09:45:11Z","modified":"2024-08-03T23:10:30.239Z","cwes":["CWE-834"],"updated_at":"2026-11-02T14:33:05.665371Z"}],"euvd":[{"id":"EUVD-2021-1279","description":"In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.","status":"published","published":"2021-06-12T09:45:11Z","modified":"2024-08-03T23:10:30Z","updated_at":"2026-11-03T03:24:38.423371Z"}],"ghsa":[{"id":"GHSA-7grw-6pjh-jpc9","title":"Infinite Loop in Apache PDFBox","description":"In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.","status":"published","published":"2021-06-15T15:54:29Z","modified":"2023-01-27T05:02:27Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-834","CWE-835"],"updated_at":"2026-11-02T14:36:18.427692Z"}],"nvd":[{"id":"CVE-2021-31812","description":"In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.","status":"published","published":"2021-06-12T10:15:07.653Z","modified":"2026-06-17T03:52:16.833Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-834","CWE-835"],"updated_at":"2026-11-02T14:06:54.892562Z"}],"osv":[{"id":"CVE-2021-31812","description":"In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.","status":"published","published":"2021-06-12T10:15:07.653Z","modified":"2026-10-24T10:30:24.065618192Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:19.483607Z"},{"id":"DEBIAN-CVE-2021-31812","description":"In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.","status":"published","published":"2021-06-12T10:15:07.653Z","modified":"2026-10-23T18:03:26.904675711Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:34.94143Z"},{"id":"GHSA-7grw-6pjh-jpc9","title":"Infinite Loop in Apache PDFBox","description":"In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.","status":"published","published":"2021-06-15T15:54:29Z","modified":"2024-03-08T05:18:50.960251Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-834","CWE-835"],"updated_at":"2026-11-02T15:46:41.002603Z"},{"id":"OESA-2021-1256","title":"pdfbox security update","description":"Apache PDFBox is an open source Java PDF library for working with PDF documents. This project allows creation of new PDF documents, manipulation of existing documents and the ability to extract content from documents. Apache PDFBox also includes several command line utilities. Apache PDFBox is published under the Apache License v2.0.\r\n\r\nSecurity Fix(es):\r\n\r\nIn Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.(CVE-2021-31811)\n\nIn Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.(CVE-2021-31812)","status":"published","published":"2021-07-03T11:04:29Z","modified":"2026-08-18T01:15:48.035742388Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"UBUNTU-CVE-2021-31812","description":"In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.","status":"published","published":"2021-06-12T10:15:00Z","modified":"2026-10-17T12:56:15.051869103Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:27.332852Z"},{"id":"MGASA-2021-0378","title":"Updated pdfbox packages fix security vulnerabilities","description":"In Apache PDFBox, a carefully crafted PDF file can trigger an\nOutOfMemory-Exception while loading the file. This issue affects Apache PDFBox\nversion 2.0.23 and prior 2.0.x versions (CVE-2021-31811).\n\nIn Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop\nwhile loading the file. This issue affects Apache PDFBox version 2.0.23 and\nprior 2.0.x versions (CVE-2021-31812).\n","status":"published","published":"2021-07-27T20:21:53Z","modified":"2026-04-16T04:43:31.076343191Z","updated_at":"2026-11-02T15:49:41.509337Z"}]}}