CVE-2021-31812: pdfbox-parent fixed in 2.0.24

CVE-2021-31812 PUBLISHED CVSS 8.699999809265137 HIGH

Infinite Loop in Apache PDFBox

Record from NVD · Published June 12, 2021

pdfbox-parent is fixed in 2.0.24 (Maven Central)

In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.

EPSS 3.05% · 87.6th percentile

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
org.apache.pdfbox:pdfbox-parent	Maven Central	2.0.24
org.apache.pdfbox:pdfbox	Maven Central	2.0.24, 2.0.23
Apache PDFBox	Apache Software Foundation	2.0.24
pdfbox	apache	2.0.23

Risk scores

CVSS 4.0

8.699999809265137

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

EPSS Score

3.05%

87.6th percentile

Affected products

Vendor	Product	Versions
oracle	banking_credit_facilities_process_management	14.2.0, 14.3.0, 14.5.0
oracle	banking_corporate_lending_process_management	14.3.0, 14.5.0, 14.2.0
fedoraproject	fedora	34, 33
oracle	communications_messaging_server	8.1
oracle	retail_customer_management_and_segmentation_foundation	18.1
apache	pdfbox	2.0.0
oracle	banking_supply_chain_finance	14.5.0, 14.3.0, 14.2.0

Timeline

Jun 12, 2021 CVE Published
Jun 13, 2021 EPSS Score (30 in total, the first dated here)
Mar 17, 2026 Security Advisory
Aug 1, 2026 Coalition ESS Score

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2021-31812
vulnetix vdb fixes CVE-2021-31812

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2021-31812/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →