CVE-2024-22640
📋 TL;DR
TCPDF versions up to 6.6.5 contain a ReDoS vulnerability in color parsing that allows attackers to cause denial of service by providing specially crafted HTML with malicious color values. This affects any application using TCPDF to generate PDFs from untrusted HTML input. The vulnerability can cause excessive CPU consumption and service unavailability.
💻 Affected Systems
- TCPDF
📦 What is this software?
Fedora by Fedoraproject
Tcpdf by Tcpdf Project
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to CPU exhaustion, potentially affecting multiple users or systems if the PDF generation service is shared.
Likely Case
Degraded performance or temporary unavailability of PDF generation functionality for affected requests.
If Mitigated
Minimal impact if input validation filters malicious color patterns before reaching TCPDF.
🎯 Exploit Status
Proof of concept available on GitHub. Exploitation requires ability to submit HTML to be processed by TCPDF.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.6.6
Vendor Advisory: https://github.com/tecnickcom/TCPDF
Restart Required: No
Instructions:
1. Update TCPDF to version 6.6.6 or later. 2. Replace the TCPDF library files with the patched version. 3. Test PDF generation functionality.
🔧 Temporary Workarounds
Input Validation
allValidate and sanitize HTML input before passing to TCPDF, particularly color attributes.
Rate Limiting
allImplement rate limiting on PDF generation endpoints to prevent repeated exploitation attempts.
🧯 If You Can't Patch
- Implement strict input validation to reject or sanitize color attributes in HTML
- Monitor CPU usage on PDF generation services and implement circuit breakers
🔍 How to Verify
Check if Vulnerable:
Check TCPDF version in code or composer.json. If version <= 6.6.5 and HTML parsing is used, system is vulnerable.Check Version:
Check composer.json for "tecnickcom/tcpdf" version or examine TCPDF.php file for version constant.Verify Fix Applied:
Verify TCPDF version is 6.6.6 or later. Test with known malicious color patterns to ensure they are rejected.📡 Detection & Monitoring
Log Indicators:
- High CPU usage on PDF generation processes
- Long-running PDF generation requests
- Multiple failed PDF generation attempts
Network Indicators:
- Repeated requests to PDF generation endpoints with HTML payloads
- Unusually large HTML payloads containing color attributes
SIEM Query:
source="web_server" AND (uri="*/pdf*" OR uri="*/generate*" OR method="POST") AND status="500" AND duration>10s🔗 References
- https://github.com/tecnickcom/TCPDF
- https://github.com/zunak/CVE-2024-22640
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LIB3R2WB7XPW2I4PGVMZ3VLFLRHOK4RB/
- https://github.com/tecnickcom/TCPDF
- https://github.com/zunak/CVE-2024-22640
- https://lists.debian.org/debian-lts-announce/2025/06/msg00004.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LIB3R2WB7XPW2I4PGVMZ3VLFLRHOK4RB/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LIB3R2WB7XPW2I4PGVMZ3VLFLRHOK4RB/
