Author: tilman Date: Wed Aug 26 10:49:50 2026 New Revision: 1937486 Log: PDFBOX-6244: Clarify that parsing doesn't check signatures (text by github copilot)
Modified: pdfbox/trunk/SECURITY.md Modified: pdfbox/trunk/SECURITY.md ============================================================================== --- pdfbox/trunk/SECURITY.md Wed Aug 26 10:21:08 2026 (r1937485) +++ pdfbox/trunk/SECURITY.md Wed Aug 26 10:49:50 2026 (r1937486) @@ -49,6 +49,8 @@ PDF files **to a limited degree**: rather than security vulnerabilities. Pure resource exhaustion findings without privilege escalation or unauthorized access are generally out of scope (e.g. tenant starvation, indexing-service disruption from a tiny crafted input). + Failure to detect a PDF containing an invalid signature is considered a limitation + of unsupported functionality and not a security vulnerability. ### Deployment and sandboxing
