CyberRota Analysis
AI-GeneratedThe veraPDF PDF parser is vulnerable to a denial-of-service attack due to improper handling of crafted Type 0 font /Encoding or /ToUnicode CMap streams, which can lead to unbounded memory allocation or excessive CPU usage. This issue affects versions prior to 1.30.2 and 1.31.23, and organizations utilizing veraPDF for PDF processing should prioritize upgrading to the latest versions to mitigate potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.30.2 and 1.31.23, veraPDF-parser contains a denial-of-service vulnerability in veraPDF-parser/src/main/java/org/verapdf/pd/font/cmap/CMapParser.java and veraPDF-parser/src/main/java/org/verapdf/parser/postscript/PSOperator.java, where a crafted Type 0 font /Encoding or /ToUnicode CMap stream can execute unbounded PostScript array allocation or a zero-increment for loop and exhaust validator memory or CPU. This issue is fixed in versions 1.30.2 and 1.31.23.