What’s Vulnerable › Vulnerabilities
CVE-2021-27906: A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file
- Severity: medium (CVSS 5.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 3.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2021-03-19 · updated 2026-06-17
- Weakness: CWE-789
Description
A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
Affected products
- Apache Software Foundation Apache PDFBox: from 2.0.0 through 2.0.22
- Fedoraproject Fedora: 32, 33, 34
- Oracle Banking Corporate Lending Process Management: 14.2.0, 14.3.0, 14.5.0
- Oracle Banking Credit Facilities Process Management: 14.2.0, 14.3.0, 14.5.0
- Oracle Banking Supply Chain Finance: 14.2.0, 14.3.0, 14.5.0
- Oracle Corporation Oracle Banking Trade Finance Process Management: 14.2.0, 14.3.0, 14.5.0
- Oracle Corporation Banking Treasury Management: 14.5
- Oracle Corporation Banking Virtual Account Management: 14.2.0, 14.3.0, 14.5.0
- Oracle Communications Messaging Server: 8.1
- Oracle Communications Session Report Manager: from 8.0.0 through 8.2.4.0
- Oracle Corporation FLEXCUBE Universal Banking: from 14.0.0 through 14.3.0; 14.5.0
- Oracle Corporation Oracle Hyperion Financial Reporting: 11.1.2.4, 11.2.6.0
- Oracle Corporation Oracle Hyperion Infrastructure Technology: before 11.2.8.0 — fixed in 11.2.8.0
- Oracle Corporation Outside In Technology: 8.5.5
- Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.58, 8.59
- Oracle Corporation Primavera Unifier: from 17.7 through 17.12; 18.8, 19.12, 20.12
- Oracle Corporation Retail Customer Management and Segmentation Foundation: 19.0
- Oracle Corporation Retail Xstore Point of Service: 16.0.6, 17.0.4, 18.0.3, 19.0.2, 20.0.1
- Oracle Corporation Oracle WebCenter Sites: 12.2.1.3.0, 12.2.1.4.0
How to fix
Upgrade to a fixed version: Oracle Corporation Oracle Hyperion Infrastructure Technology 11.2.8.0. Check the vendor advisory for mitigations.
References
- http://www.openwall.com/lists/oss-security/2021/03/19/10
- https://lists.apache.org/thread.html/r1218e60c32829f76943ecaca79237120c2ec1ab266459d711a578b50%40%3Cdev.pdfbox.apache.org%3E
- https://lists.apache.org/thread.html/r1d268642f8b52456ee8f876b888b8ed7a9e9568c7770789f3ded7f9e%40%3Ccommits.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r4cbc3f6981cd0a1a482531df9d44e4c42a7f63342a7ba78b7bff8a1b%40%3Cnotifications.james.apache.org%3E
- https://lists.apache.org/thread.html/r54594251369e14c185da9662a5340a52afbbdf75d61c9c3a69c8f2e8%40%3Cdev.pdfbox.apache.org%3E
- https://lists.apache.org/thread.html/r5c8e2125d18af184c80f7a986fbe47eaf0d30457cd450133adc235ac%40%3Ccommits.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r64982b768c8a2220b07aaf813bd099a9863de0d13eb212fd4efe208f%40%3Cusers.pdfbox.apache.org%3E
- https://lists.apache.org/thread.html/r6e067a6d83ccb6892d0ff867bd216704f21fb0b6a854dea34be04f12%40%3Cnotifications.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r7ee634c21816c69ce829d0c41f35afa2a53a99bdd3c7cce8644fdc0e%40%3Cnotifications.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r9ffe179385637b0b5cbdabd0246118005b4b8232909d2d14cd68ccd3%40%3Ccommits.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/raa35746227f3f8d50fff1db9899524423a718f6f35cd39bd4769fa6c%40%3Cnotifications.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/rc69140d894c6a9c67a8097a25656cce59b46a5620c354ceba10543c3%40%3Cnotifications.ofbiz.apache.org%3E
Get alerted when CVE-2021-27906 or the next vulnerability affects your stack