TCPDF vulnerable to Regular Expression Denial of Service
Date: 2024-04
Affected: composer/tecnickcom/tcpdf
Attack vector: dos
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2024-22640
CWE: CWE-1333

TCPDF version <= 6.7.4 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color.


Mitigations:

Architectural layers (MAESTRO):