PT-2024-19517 · Tcpdf+2 · Tcpdf+2

Zunak · Published 2024-05-28 · Updated 2025-08-21 · CVE-2024-22641

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions TCPDF versions 6.6.5 and earlier

Description The issue arises when parsing an untrusted SVG file, leading to a ReDoS (Regular Expression Denial of Service) condition. This occurs due to the inefficient handling of regular expressions within the TCPDF library, specifically when it encounters maliciously crafted SVG files. The ReDoS condition can cause the application to consume excessive resources, resulting in a denial-of-service state.

Recommendations For TCPDF versions 6.6.5 and earlier, consider updating to a version that addresses this issue, as no specific workaround is provided for these versions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Unrestricted File Upload

Weakness Enumeration

CWE-1333

CWE-434

Related Identifiers

BDU:2025-10861

CVE-2024-22641

DLA-4199-1

DSA-5933-1

MGASA-2024-0361

Affected Products

Debian

Red Os

Tcpdf

References · 20

• 🔥 https://github.com/zunak/CVE-2024-22641 · Exploit
• https://osv.dev/vulnerability/DLA-4199-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-10861 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-22641 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-22641 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-22641 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22641 · Security Note
• https://advisories.mageia.org/MGASA-2024-0361.html · Security Note
• https://osv.dev/vulnerability/DSA-5933-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-22641 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/WGK7LQSJONZPU3VOQTQ36UN6OAD6ZM4H · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2024-0361 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-22641 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-22641 · Vendor Advisory