The Apache PDFBox® library is an open source Java tool for working with PDF documents. This project allows creation of new PDF documents, manipulation of existing documents and the ability to extract content from documents. Apache PDFBox also includes several command-line utilities.
The library is prone to a denial of service condition caused by a disproportionate heap allocation in the Flate decode PNG predictor path. When a stream is filtered with FlateDecode and a predictor is declared, PDFBox sizes an internal decoding buffer directly from the PDF-supplied decode parameters (/Columns, /Colors and /BitsPerComponent) inside org.apache.pdfbox.filter.Predictor. The /Columns value is taken from the untrusted document and is not bounded against the actual stream length, so a crafted stream a few hundred bytes in size forces an allocation of hundreds of megabytes. A confirmed 396 byte PDF drives an allocation of roughly 250 MB inside Predictor$PredictorOutputStream.<init>, and under a constrained heap the process terminates with java.lang.OutOfMemoryError.
The condition is reached during normal document processing when the affected stream is decoded (content stream, object stream, image XObject or cross-reference stream), requires no authentication and no user interaction beyond submitting a PDF to a feature that already accepts one. PDFBox guards the integer overflow case, throwing an IOException ("Calculated row length is negative") for values that wrap negative, but the large positive range remains unbounded. A related unbounded FlateDecode output buffer (decompression bomb, a small stream inflating to gigabytes) amplifies the same denial of service class.