Author: msahyoun Date: Tue Aug 25 20:27:52 2026 New Revision: 1937455 Log: PDFBOX-6241: align the security definition on the web page and for agents
Modified: pdfbox/trunk/SECURITY.md Modified: pdfbox/trunk/SECURITY.md ============================================================================== --- pdfbox/trunk/SECURITY.md Tue Aug 25 20:19:50 2026 (r1937454) +++ pdfbox/trunk/SECURITY.md Tue Aug 25 20:27:52 2026 (r1937455) @@ -38,20 +38,17 @@ PDFBox supports processing of untrusted PDF files **to a limited degree**: - **In scope**: Remote code execution, privilege escalation, unauthorized data - access, escape from an embedding application's sandbox or security boundary, - or disproportionate resource amplification (i.e. small attacker-controlled - inputs triggering catastrophic memory or CPU consumption) caused by processing - an untrusted PDF document. These are genuine vulnerabilities and should be - reported privately. + access or escape from an embedding application's sandbox or security boundary, + caused by processing an untrusted PDF document. These are genuine vulnerabilities + and should be reported privately. - **Known limitations (not vulnerabilities)**: Malformed PDFs may cause unchecked exceptions such as `NullPointerException` or `StackOverflowError`, or may consume significant memory or CPU relative to document size. General parser and resource exhaustion issues are treated as robustness limitations rather than security vulnerabilities. Pure resource exhaustion findings - without privilege escalation, unauthorized access, or disproportionate - amplification (e.g. tenant starvation, indexing-service disruption from a - tiny crafted input) are generally out of scope. + without privilege escalation or unauthorized access are generally out of scope + (e.g. tenant starvation, indexing-service disruption from a tiny crafted input). ### Deployment and sandboxing
