CVE-2021-27906: Apache Pdfbox

Medium severity, CVSS 5.5. EPSS: 3.3% chance of exploitation in the next 30 days.

A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.

Affected products

Apache Pdfbox: from 2.0.0, up to and including 2.0.22
Fedoraproject Fedora: version 32 only; version 33 only; version 34 only
Oracle Banking Corporate Lending Process Management: version 14.2.0 only; version 14.3.0 only; version 14.5.0 only
Oracle Banking Credit Facilities Process Management: version 14.2.0 only; version 14.3.0 only; version 14.5.0 only
Oracle Banking Supply Chain Finance: version 14.2.0 only; version 14.3.0 only; version 14.5.0 only
Oracle Banking Trade Finance Process Management: version 14.2.0 only; version 14.3.0 only; version 14.5.0 only
Oracle Banking Treasury Management: version 14.5 only
Oracle Banking Virtual Account Management: version 14.2.0 only; version 14.3.0 only; version 14.5.0 only
Oracle Communications Messaging Server: version 8.1 only
Oracle Communications Session Report Manager: from 8.0.0, up to and including 8.2.4.0
Oracle Flexcube Universal Banking: from 14.0.0, up to and including 14.3.0; version 14.5.0 only
Oracle Hyperion Financial Reporting: version 11.1.2.4 only; version 11.2.6.0 only
Oracle Hyperion Infrastructure Technology: before 11.2.8.0 (fixed in 11.2.8.0)
Oracle Outside In Technology: version 8.5.5 only
Oracle PeopleSoft Enterprise PeopleTools: version 8.58 only; version 8.59 only
Oracle Primavera Unifier: from 17.7, up to and including 17.12; version 18.8 only; version 19.12 only; version 20.12 only
Oracle Retail Customer Management And Segmentation Foundation: version 19.0 only
Oracle Retail Xstore Point Of Service: version 16.0.6 only; version 17.0.4 only; version 18.0.3 only; version 19.0.2 only; version 20.0.1 only
Oracle Webcenter Sites: version 12.2.1.3.0 only; version 12.2.1.4.0 only

Published 2021-03-19. Last modified 2026-06-17.