Apache Pdfbox vulnerabilities

9 CVEs affecting Apache Pdfbox, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-33929, published 2026-04-14.

More from Apache.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2019-0228, published 2019-04-17. Critical severity, CVSS 9.8. EPSS: 9.5% chance of exploitation in the next 30 days. Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.
• CVE-2018-8036, published 2018-07-03. Medium severity, CVSS 6.5. EPSS: 4.8% chance of exploitation in the next 30 days. In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.
• CVE-2016-2175, published 2016-06-01. High severity, CVSS 7.8. EPSS: 3.8% chance of exploitation in the next 30 days. Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.
• CVE-2021-31811, published 2021-06-12. Medium severity, CVSS 5.5. EPSS: 3.6% chance of exploitation in the next 30 days. In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
• CVE-2018-11797, published 2018-10-05. Medium severity, CVSS 5.5. EPSS: 3.5% chance of exploitation in the next 30 days. In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree.
• CVE-2021-27906, published 2021-03-19. Medium severity, CVSS 5.5. EPSS: 3.3% chance of exploitation in the next 30 days. A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
• CVE-2021-31812, published 2021-06-12. Medium severity, CVSS 5.5. EPSS: 3.1% chance of exploitation in the next 30 days. In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
• CVE-2021-27807, published 2021-03-19. Medium severity, CVSS 5.5. EPSS: 3% chance of exploitation in the next 30 days. A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
• CVE-2026-33929, published 2026-04-14. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples. This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from…