CVE-2021-27807: Apache Pdfbox

Medium severity, CVSS 5.5. EPSS: 3% chance of exploitation in the next 30 days.

A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.

Affected products

• Apache Pdfbox: from 2.0.0, up to and including 2.0.22
• Fedoraproject Fedora: version 32 only; version 33 only; version 34 only
• Oracle Banking Trade Finance Process Management: version 14.2.0 only; version 14.3.0 only; version 14.5.0 only
• Oracle Banking Treasury Management: version 14.5 only
• Oracle Banking Virtual Account Management: version 14.2.0 only; version 14.3.0 only; version 14.5.0 only
• Oracle Communications Messaging Server: version 8.1 only
• Oracle Communications Session Report Manager: from 8.0.0, up to and including 8.2.4.0
• Oracle Flexcube Universal Banking: from 14.0.0, up to and including 14.3.0; version 14.5.0 only
• Oracle Hyperion Financial Reporting: version 11.1.2.4 only; version 11.2.6.0 only
• Oracle Hyperion Infrastructure Technology: before 11.2.8.0 (fixed in 11.2.8.0)
• Oracle Outside In Technology: version 8.5.5 only
• Oracle Primavera Unifier: from 17.7, up to and including 17.12; version 18.8 only; version 19.12 only; version 20.12 only
• Oracle Retail Customer Management And Segmentation Foundation: version 19.0 only
• Oracle Retail Xstore Point Of Service: version 16.0.6 only; version 17.0.4 only; version 18.0.3 only; version 19.0.2 only; version 20.0.1 only
• Oracle Webcenter Sites: version 12.2.1.3.0 only; version 12.2.1.4.0 only

Published 2021-03-19. Last modified 2026-06-17.