Author: tilman Date: Wed Aug 26 12:46:49 2026 New Revision: 1937488 Log: PDFBOX-6244: Clarify that parsing doesn't check signatures, by Maruan Sahyoun
Modified: pdfbox/trunk/SECURITY.md Modified: pdfbox/trunk/SECURITY.md ============================================================================== --- pdfbox/trunk/SECURITY.md Wed Aug 26 12:10:04 2026 (r1937487) +++ pdfbox/trunk/SECURITY.md Wed Aug 26 12:46:49 2026 (r1937488) @@ -49,8 +49,10 @@ PDF files **to a limited degree**: rather than security vulnerabilities. Pure resource exhaustion findings without privilege escalation or unauthorized access are generally out of scope (e.g. tenant starvation, indexing-service disruption from a tiny crafted input). - Failure to detect a PDF containing an invalid signature is considered a limitation - of unsupported functionality and not a security vulnerability. + PDF signature validation is unsupported. The project does not provide + cryptographic validation of PDF signatures, and applications requiring + signature validation must perform that validation using a dedicated, + trusted component. ### Deployment and sandboxing
