CVE-2021-31811: A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading a tiny file

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-06-12 · updated 2026-06-17
Weakness: CWE-789

Description

In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.

Affected products

Apache Software Foundation Apache PDFBox: from 2.0.0 through 2.0.23
Fedoraproject Fedora: 33, 34
Oracle Banking Corporate Lending Process Management: 14.2.0, 14.3.0, 14.5.0
Oracle Banking Credit Facilities Process Management: 14.2.0, 14.3.0, 14.5.0
Oracle Banking Supply Chain Finance: 14.2.0, 14.3.0, 14.5.0
Oracle Corporation Banking Trade Finance: 14.5
Oracle Corporation Banking Treasury Management: 14.5
Oracle Communications Messaging Server: 8.1
Oracle Corporation FLEXCUBE Universal Banking: from 14.0.0 through 14.3.0; 14.5
Oracle Corporation Outside In Technology: 8.5.5
Oracle Corporation Primavera Unifier: from 17.7 through 17.12; 18.8, 19.12, 20.12
Oracle Corporation Retail Customer Management and Segmentation Foundation: 18.1

References

Get alerted when CVE-2021-31811 or the next vulnerability affects your stack