This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/pdfbox-docs.git
The following commit(s) were added to refs/heads/asf-site by this push:
new 3c96d2e6 Site checkin for project Apache PDFBox Website
3c96d2e6 is described below
commit 3c96d2e6fd3705588c85dd97ebf7d20a79e2b9aa
Author: Maruan Sahyoun <[email protected]>
AuthorDate: Thu Aug 27 12:19:38 2026 +0200
Site checkin for project Apache PDFBox Website
---
content/2.0/faq.html | 3 +--
content/3.0/faq.html | 3 +--
content/security.html | 48 +++++++++++++++++++++++++++++++++++++++++-------
3 files changed, 43 insertions(+), 11 deletions(-)
diff --git a/content/2.0/faq.html b/content/2.0/faq.html
index fb250730..c24923f9 100644
--- a/content/2.0/faq.html
+++ b/content/2.0/faq.html
@@ -300,8 +300,7 @@ The ShowSignature example does a partial verification and
validation,
but it can't detect allowed or forbidden changes, annd UR3 isn't supported at
all.
Certificates are checked up to the root certificate,
but it does not check the root certificate against AATL and EUTL.
-This is mostly a developer tool to create your own.
-The gold standard is Adobe Reader.</p>
+This is mostly a developer tool to create your own.</p>
</section>
<aside>
diff --git a/content/3.0/faq.html b/content/3.0/faq.html
index 4f2cb5f5..173cd9e5 100644
--- a/content/3.0/faq.html
+++ b/content/3.0/faq.html
@@ -309,8 +309,7 @@ The ShowSignature example does a partial verification and
validation,
but it can't detect allowed or forbidden changes, annd UR3 isn't supported at
all.
Certificates are checked up to the root certificate,
but it does not check the root certificate against AATL and EUTL.
-This is mostly a developer tool to create your own.
-The gold standard is Adobe Reader.</p>
+This is mostly a developer tool to create your own.</p>
</section>
<aside>
diff --git a/content/security.html b/content/security.html
index 8265c17b..03d8253e 100644
--- a/content/security.html
+++ b/content/security.html
@@ -156,13 +156,47 @@
<div class="col-xs-12 col-sm-9">
<h1 id="security" tabindex="-1">Security</h1>
<h2 id="security-model" tabindex="-1">Security Model</h2>
-<p>Processing untrusted PDFs is only supported to a point: malformed PDFs
-will not cause remote code execution or other privilege escalation
-problems. However, processing them may cause unchecked exceptions
-such as <code>StackOverflowError</code> or <code>NullPointerException</code>,
infinite loops, or even use
-unexpected amounts of memory or cpu usage, including exhaustion of these.
-See also our <a
href="https://github.com/apache/pdfbox/security/policy";>Security Scan
Guidance</a>
-for security scanners and vulnerability researchers.</p>
+<p>Processing untrusted PDFs is supported, but only to a defined extent. See
+our <a href="https://github.com/apache/pdfbox/security/policy";>Security Scan
Guidance</a>
+for the full threat model, aimed at automated scanners and vulnerability
+researchers.</p>
+<h3 id="in-scope" tabindex="-1">In scope</h3>
+<p>Please report security issues privately if processing an untrusted PDF can
+result in:</p>
+<ul>
+<li>remote code execution;</li>
+<li>privilege escalation or escape from the application's or execution
+environment's intended security boundary; or</li>
+<li>unauthorized access to data that the application or PDFBox would not
+otherwise be permitted to access.</li>
+</ul>
+<p>These issues are considered security vulnerabilities when the security
+impact is a direct result of processing the untrusted PDF.</p>
+<h3 id="not-vulnerabilities-under-this-policy" tabindex="-1">Not
vulnerabilities under this policy</h3>
+<p>Malformed or specially crafted PDFs may cause unchecked exceptions such as
+<code>NullPointerException</code> or <code>StackOverflowError</code>, infinite
loops, or resource
+consumption that is disproportionate to the size or complexity of the
input.</p>
+<p>These behaviors may be bugs or robustness limitations, but they are not
+considered security vulnerabilities under this policy. In particular,
+denial-of-service conditions that are limited to excessive CPU, memory,
+recursion, or processing time are outside the security scope described
here.</p>
+<p>Applications that process untrusted documents at scale should apply
+appropriate timeouts, memory limits, resource controls, and sandboxing.</p>
+<h3 id="document-validation" tabindex="-1">Document validation</h3>
+<p>PDFBox is a low-level library. It does not automatically validate
+signatures, permissions, PDF/A or other standards conformance, or similar
+document-level properties unless the application explicitly invokes the
+relevant PDFBox verification API.</p>
+<p>The absence of such validation is not itself a vulnerability. However, an
+incorrect security-relevant result from an explicitly invoked PDFBox
+verification API is within scope.</p>
+<h3 id="encryption-and-signatures" tabindex="-1">Encryption and signatures</h3>
+<p>PDF encryption and signatures rely on the Java Cryptography Architecture
+(JCA) and Bouncy Castle. Vulnerabilities in those underlying cryptographic
+libraries should be reported to their respective upstream projects.</p>
+<p>Incorrect use of those libraries within PDFBox remains in scope. Examples
+include a flawed key derivation implementation or a permission bypass caused
+by PDFBox's handling of encryption or signatures.</p>
<h2 id="reporting-security-issues" tabindex="-1">Reporting security issues</h2>
<p>The Apache Software Foundation takes a very active stance in eliminating
and disclosing security problems against its products.</p>
<p>We strongly encourage folks to report such problems to our private security
mailing list first, before disclosing them in a public forum.</p>
