What’s Vulnerable › Vulnerabilities
CVE-2021-27807: A carefully crafted PDF file can trigger an infinite loop while loading the file
- Severity: medium (CVSS 5.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 3.0% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2021-03-19 · updated 2026-06-17
- Weakness: CWE-834
Description
A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
Affected products
- Apache Software Foundation Apache PDFBox: from 2.0.0 through 2.0.22
- Fedoraproject Fedora: 32, 33, 34
- Oracle Corporation Oracle Banking Trade Finance Process Management: 14.2.0, 14.3.0, 14.5.0
- Oracle Corporation Banking Treasury Management: 14.5
- Oracle Corporation Banking Virtual Account Management: 14.2.0, 14.3.0, 14.5.0
- Oracle Communications Messaging Server: 8.1
- Oracle Communications Session Report Manager: from 8.0.0 through 8.2.4.0
- Oracle Corporation FLEXCUBE Universal Banking: from 14.0.0 through 14.3.0; 14.5.0
- Oracle Corporation Oracle Hyperion Financial Reporting: 11.1.2.4, 11.2.6.0
- Oracle Corporation Oracle Hyperion Infrastructure Technology: before 11.2.8.0 — fixed in 11.2.8.0
- Oracle Corporation Outside In Technology: 8.5.5
- Oracle Corporation Primavera Unifier: from 17.7 through 17.12; 18.8, 19.12, 20.12
- Oracle Corporation Retail Customer Management and Segmentation Foundation: 19.0
- Oracle Corporation Retail Xstore Point of Service: 16.0.6, 17.0.4, 18.0.3, 19.0.2, 20.0.1
- Oracle Corporation Oracle WebCenter Sites: 12.2.1.3.0, 12.2.1.4.0
How to fix
Upgrade to a fixed version: Oracle Corporation Oracle Hyperion Infrastructure Technology 11.2.8.0. Check the vendor advisory for mitigations.
References
- http://www.openwall.com/lists/oss-security/2021/03/19/9
- https://lists.apache.org/thread.html/r043edc5dcf9199f7f882ed7906b41cb816753766e88b8792dbf319a9%40%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/r1218e60c32829f76943ecaca79237120c2ec1ab266459d711a578b50%40%3Cdev.pdfbox.apache.org%3E
- https://lists.apache.org/thread.html/r1d268642f8b52456ee8f876b888b8ed7a9e9568c7770789f3ded7f9e%40%3Ccommits.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r4717f902f8bc36d47b3fa978552a25e4ed3ddc2fffb52b94fbc4ab36%40%3Cusers.pdfbox.apache.org%3E
- https://lists.apache.org/thread.html/r4cbc3f6981cd0a1a482531df9d44e4c42a7f63342a7ba78b7bff8a1b%40%3Cnotifications.james.apache.org%3E
- https://lists.apache.org/thread.html/r54594251369e14c185da9662a5340a52afbbdf75d61c9c3a69c8f2e8%40%3Cdev.pdfbox.apache.org%3E
- https://lists.apache.org/thread.html/r5c8e2125d18af184c80f7a986fbe47eaf0d30457cd450133adc235ac%40%3Ccommits.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r6e067a6d83ccb6892d0ff867bd216704f21fb0b6a854dea34be04f12%40%3Cnotifications.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r7ee634c21816c69ce829d0c41f35afa2a53a99bdd3c7cce8644fdc0e%40%3Cnotifications.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r818058ff1e4b9f6bef4e5a2e74faff38cb3d3885c1e2db398bc55cfb%40%3Cusers.pdfbox.apache.org%3E
- https://lists.apache.org/thread.html/r818058ff1e4b9f6bef4e5a2e74faff38cb3d3885c1e2db398bc55cfb%40%3Cusers.pdfbox.apache.org%3E
Get alerted when CVE-2021-27807 or the next vulnerability affects your stack