← Advisories

Apache PDFBox 3.0.8 Flate PNG Predictor Disproportionate Heap Allocation DoS

Low
Advisory ID
ZSL-2026-6004
Release Date
20 September 2026
Vendor
The Apache Software Foundation - https://www.apache.org
Affected Version
2.0.37, 3.0.8
Tested On
Eclipse Temurin OpenJDK 21.0.6 (LTS), Microsoft Windows 10
Summary

The Apache PDFBox® library is an open source Java tool for working with PDF documents. This project allows creation of new PDF documents, manipulation of existing documents and the ability to extract content from documents. Apache PDFBox also includes several command-line utilities.

Description

The library is prone to a denial of service condition caused by a disproportionate heap allocation in the Flate decode PNG predictor path. When a stream is filtered with FlateDecode and a predictor is declared, PDFBox sizes an internal decoding buffer directly from the PDF-supplied decode parameters (/Columns, /Colors and /BitsPerComponent) inside org.apache.pdfbox.filter.Predictor. The /Columns value is taken from the untrusted document and is not bounded against the actual stream length, so a crafted stream a few hundred bytes in size forces an allocation of hundreds of megabytes. A confirmed 396 byte PDF drives an allocation of roughly 250 MB inside Predictor$PredictorOutputStream.<init>, and under a constrained heap the process terminates with java.lang.OutOfMemoryError.

The condition is reached during normal document processing when the affected stream is decoded (content stream, object stream, image XObject or cross-reference stream), requires no authentication and no user interaction beyond submitting a PDF to a feature that already accepts one. PDFBox guards the integer overflow case, throwing an IOException ("Calculated row length is negative") for values that wrap negative, but the large positive range remains unbounded. A related unbounded FlateDecode output buffer (decompression bomb, a small stream inflating to gigabytes) amplifies the same denial of service class.

Proof of Concept
Disclosure Timeline
21.08.2026Vulnerability discovered.
23.08.2026Contact with the vendor.
25.08.2026Vendor forwards details to appropriate PMC.
26.08.2026Vendor asks for more details.
26.08.2026Sent details to the vendor.
10.09.2026No response from the vendor.
11.09.2026Asked vendor for status update.
14.09.2026Vendor recently resolved an ambiguity in their security policy. As a result exhaustion of resources isn't considered to be a vulnerability. Will create an issue in JIRA.
14.09.2026Replied to the vendor.
15.09.2026Vendor secures the predictor (PDFBOX-6265).
20.09.2026Public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
High five to Tilman!
References
Changelog
20.09.2026Initial release