itextpdf itext vulnerabilities

Latest itextpdf itext CVEs

Newest publication first

1. CVE-2023-6299 Apryse iText Reference Table PdfDocument.java memory leak

   Published 2023-11-26

   Medium·CVSS 6.5 EPSS 0.94%

   A vulnerability, which was classified as problematic, has been found in Apryse iText 8.0.1. This issue affects some unknown processing of the file PdfDocument.java of the component Reference Table Handler. The manipulation leads to memory leak. The attack may be initiated remotel...

2. CVE-2022-24196 Allocation of Resources Without Limits or Throttling in iText

   Published 2022-02-01

   Medium·CVSS 6.5 EPSS 1.4%

   iText v7.1.17, up to (exluding)": 7.1.18 and 7.2.2 was discovered to contain an out-of-memory error via the component readStreamBytesRaw, which allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.

3. CVE-2022-24197 Out-of-bounds Write in iText

   Published 2022-02-01

   Medium·CVSS 6.5 EPSS 1.3%

   iText v7.1.17 was discovered to contain a stack-based buffer overflow via the component ByteBuffer.append, which allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.

4. CVE-2021-43113 Command injection in itext7-core

   Published 2021-12-15

   Critical·CVSS 9.8 EPSS 5.4%

   iTextPDF in iText 7 and up to (excluding 4.4.13.3) 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs (aka Ghostscript) command line in GhostscriptHelper.java.

5. CVE-2017-9096 Improper Restriction of XML External Entity Reference in iText

   Published 2017-11-08

   High·CVSS 8.8 EPSS 9.6%

   The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external entities, which might allow remote attackers to conduct XML external entity (XXE) attacks via a crafted PDF.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.