PT-2024-19516 · Tcpdf+2 · Tcpdf+2

Zunak · Published 2024-04-19 · Updated 2025-08-21 · CVE-2024-22640

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions TCPDF versions <= 6.6.5

Description The issue concerns a ReDoS (Regular Expression Denial of Service) vulnerability that occurs when parsing an untrusted HTML page with a crafted color. This can lead to a denial of service.

Recommendations For TCPDF versions <= 6.6.5, as a temporary workaround, consider avoiding the parsing of untrusted HTML pages until a patch is available. Restrict access to the HTML parsing functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

BDU:2025-10860

CVE-2024-22640

DLA-4199-1

DSA-5933-1

GHSA-MX3P-FHPW-X6RV

MGASA-2024-0169

Affected Products

Debian

Red Os

Tcpdf

References · 23

• 🔥 https://github.com/zunak/CVE-2024-22640 · Exploit
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LIB3R2WB7XPW2I4PGVMZ3VLFLRHOK4RB · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4199-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-22640 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22640 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-22640 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2024-0169.html · Security Note
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-22640 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-22640 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-22640 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/LIB3R2WB7XPW2I4PGVMZ3VLFLRHOK4RB · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-10860 · Security Note
• https://osv.dev/vulnerability/GHSA-mx3p-fhpw-x6rv · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5933-1 · Vendor Advisory