GitHub Advisoryadvisory · Packagist

GHSA-mx3p-fhpw-x6rv TCPDF vulnerable to Regular Expression Denial of Service

MEDIUM Published 2024-04-19 Modified 2025-11-04 Official page ↗
Aliases
CVE-2024-22640
Ecosystem
Packagist
Packages
tecnickcom/tcpdf
Severity
Moderate
CVSS vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weaknesses
CWE-1333
Reviewed
2024-04-19

Affected packages

• Packagist tecnickcom/tcpdf: < 6.7.5 → fixed in 6.7.5

Description

TCPDF version <= 6.7.4 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color.

Related

Alias · CVE (1)

  • CVE-2024-22640 TCPDF version <=6.6.5 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color. vulnerability

Weakness · CWE (1)

  • CWE-1333 Inefficient Regular Expression Complexity weakness

References