CVE-2021-27807

5.5 mediumEPSS 3.0%

Medium (5.5). EPSS 3.0% chance of exploitation in the next 30 days. Fixed in org.apache.pdfbox:pdfbox 2.0.23.

A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.

Severity

CVSS 3.1

5.5 medium

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS: 3.0% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-31)
CWE: CWE-834
Published: 2021-03-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apache:pdfbox
fedoraproject:fedora
oracle:banking_trade_finance_process_management
oracle:banking_treasury_management
oracle:banking_virtual_account_management
oracle:communications_messaging_server
oracle:communications_session_report_manager
oracle:flexcube_universal_banking
oracle:hyperion_financial_reporting
oracle:hyperion_infrastructure_technology
oracle:outside_in_technology
oracle:primavera_unifier
oracle:retail_customer_management_and_segmentation_foundation
oracle:retail_xstore_point_of_service
oracle:webcenter_sites

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-2h3j-m7gr-25xj	Maven	org.apache.pdfbox:pdfbox	>=2.0.0 <2.0.23	2.0.23

References

Check your stack JSON