Vulnerability Database · Debian · Package report
libpdfbox-java: vulnerability history, versions and safety
libpdfbox-java is a package in the Debian ecosystem. Vulert records 10 vulnerabilities for it across 4 releases, from Jun 2016 to Apr 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.
No patched version yet — these are the ones to plan around.
See the unfixed vulnerabilities →No published version shipped hostile code.
Vulert verdict on libpdfbox-java i
Updated on 23 Oct 2026
Careful: 4 of the 10 vulnerabilities Vulert records for this package have no fix yet. Plan around those, or apply the workaround listed for each. The rest have a fixed version to move to.
What to do: Plan around the 4 vulnerabilities with no published fix: each lists the affected range and any workaround that reduces exposure. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →
- Vulnerabilities on record 10 over 9 years · 2 in the last year i
- Latest disclosure 14 Apr 2026 i
- Highest CVSS 7.8 i
- With no published fix 4 i
Concerned about your application's security?
Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.
01 Versions
Which versions are affected
Every version Vulert holds for libpdfbox-java, newest first, with the vulnerabilities that name it. A version with a count of zero has no recorded vulnerabilities; open a version to see the vulnerabilities it is exposed to.
| Version | Vulert vulnerabilities | Fix published | Details |
|---|---|---|---|
| 1:1.8.16-5 | U4 | No | Details → |
| 1:1.8.16-4 | U4 | No | Details → |
| 1:1.8.16-3 | U4 | No | Details → |
| 1:1.8.16-2 | U4 | No | Details → |
Newest 4 of 4 versions on record. Severity counts are the vulnerabilities recorded against that exact release.
02 Disclosure history
How often vulnerabilities are recorded
Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 2 of the 10 were recorded in the last 12 months.
03 Vulnerabilities
Recorded vulnerabilities for libpdfbox-java
| Vulnerability | Severity | Fixed version ↑ | Disclosed ↑ |
|---|---|---|---|
| XML External Entity (XXE) Vulnerability in libpdfbox-java: Apache PDFBox Versions Prior to 1.8.12 and 2.0.1 | 7.8 high | 1:1.8.12-1 | 01 Jun 2016 |
| Apache PDFBox Infinite Loop Vulnerability (CVE-2018-8036) | 6.5 medium | 1:1.8.15-1 | 03 Jul 2018 |
| Long Running Computation Vulnerability in Apache PDFBox (CVE-2018-11797) | 5.5 medium | 1:1.8.16-1 | 05 Oct 2018 |
| OutOfMemory Exception in Apache PDFBox - libpdfbox-java and libpdfbox2-java Vulnerability | 5.5 medium | No fix published | 12 Jun 2021 |
| Infinite Loop Vulnerability in Apache PDFBox (CVE-2021-31812) | 5.5 medium | No fix published | 12 Jun 2021 |
Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback
Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315
