OutOfMemory Exception in Apache PDFBox - libpdfbox-java and libpdfbox2-java Vulnerability
Summary
CVE-2021-31811: In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. Affects libpdfbox-java versions 1:1.8.16-2 – 1:1.8.16-5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache PDFBox is an open-source Java library that allows users to create, manipulate, and extract content from PDF documents. It is widely used in various applications for its ability to handle PDF files programmatically. The library is designed to be robust and efficient, but certain versions have been found to be vulnerable to specific crafted PDF files that can lead to performance issues.
Vulnerability Detail
The vulnerability identified as CVE-2021-31811 in Apache PDFBox arises when a carefully crafted PDF file is loaded, which can trigger an OutOfMemoryException. This issue affects versions 2.0.23 and earlier of the libpdfbox-java and libpdfbox2-java packages. If exploited, this vulnerability can lead to application crashes or degraded performance, as the system may exhaust available memory resources while processing the malicious PDF.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not possible, consider implementing input validation to restrict the types of PDF files that can be processed by your application. This can help mitigate the risk of encountering crafted PDF files that trigger the vulnerability.
Conclusion
The CVE-2021-31811 vulnerability in Apache PDFBox poses a risk of OutOfMemoryExceptions when processing malicious PDF files. It is crucial to update to the latest versions of the affected packages to mitigate this risk. Additionally, using input validation can serve as a temporary measure until an upgrade can be performed.
See every vulnerability recorded for libpdfbox-java →
FAQ
CVE-2021-31811 is a vulnerability in Apache PDFBox that can cause an OutOfMemoryException when processing specially crafted PDF files.
Versions 2.0.23 and earlier of both libpdfbox-java and libpdfbox2-java are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2021-31811 is 5.5, indicating a medium level of severity.
If you cannot upgrade, implement input validation to restrict the types of PDF files processed by your application as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for libpdfbox-java.
