Product by Realobjects

    RealObjects PDFreactor

    44 known vulnerabilities in RealObjects PDFreactor (Realobjects), 1 of them actively exploited (CISA KEV).

    Key figures

    44

    Vulnerabilities

    1

    Actively exploited (KEV)

    0

    Used by ransomware

    4

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in RealObjects PDFreactor (Realobjects)
    CriticalCVE-2023-44487

    HTTP/2 Rapid Reset Attack Vulnerability

    In CISA KEValso in 158 other products

    		7.5
    MediumCVE-2025-48924

    Apache Commons Lang: Uncontrolled Recursion

    also in 28 other products

    		5.3
    HighCVE-2025-23184

    Apache CXF: Denial of Service vulnerability with temporary files

    also in 18 other products

    		5.9
    HighCVE-2026-54513

    FasterXML Jackson-databind: Incomplete List of Disallowed Inputs

    also in 5 other products

    		8.1
    CriticalCVE-2019-12154

    RealObjects PDFreactor: XML External Entity (XXE)

    		9.1
    CriticalCVE-2019-12153

    RealObjects PDFreactor: Server-Side Request Forgery (SSRF)

    		10.0
    HighCVE-2026-54512

    FasterXML Jackson-databind: Incomplete List of Disallowed Inputs

    also in 8 other products

    		8.1
    CriticalCVE-2026-10050

    Digest authentication lossy encoding

    also in 3 other products

    		9.1
    MediumCVE-2023-20863

    Spring Framework: Uncontrolled Resource Consumption

    also in 7 other products

    		6.5
    HighCVE-2026-68497

    jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS

    also in 6 other products

    		7.5
    HighCVE-2026-57819

    Apache CXF: No default restriction on the amount of form parameters per message

    also in 2 other products

    		7.5
    HighCVE-2026-54225

    Apache CXF: Denial of Service attack via large attachments

    also in 2 other products

    		7.5
    HighCVE-2026-54079

    veraPDF Validation XXE via XFA

    also in 1 other product

    		—
    HighCVE-2026-54078

    veraPDF Validation XXE via Rich Text

    also in 1 other product

    		—
    HighCVE-2026-64958

    Apache CXF: Denial of service via message header attachments

    also in 2 other products

    		7.5
    HighCVE-2026-65432

    Apache CXF: XXE via WSDL/XSD import parsing

    also in 2 other products

    		7.5
    MediumCVE-2026-19032

    jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path

    also in 2 other products

    		5.3
    MediumCVE-2026-54081

    veraPDF Parser DoS via PostScript Type 1 Font Programs

    also in 1 other product

    		—
    MediumCVE-2026-54080

    veraPDF Parser DoS via PostScript CMap Streams

    also in 1 other product

    		—
    HighCVE-2025-1948

    Eclipse Jetty HTTP clients can increase memory allocation

    also in 9 other products

    		7.5
    MediumCVE-2026-64607

    Apache HttpComponents Client: Missing Release of Resource after Effective Lifetime

    also in 6 other products

    		5.3
    HighCVE-2026-10051

    Eclipse Jetty: Exposure of Sensitive Information to an Unauthorized Actor

    also in 2 other products

    		7.5
    MediumCVE-2026-59888

    jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy

    also in 4 other products

    		6.5
    MediumCVE-2026-54082

    veraPDF-validation: Improper Restriction of XML External Entity Reference

    also in 1 other product

    		6.5
    HighCVE-2024-13009

    Eclipse Jetty GZIP buffer release

    also in 11 other products

    		7.2

    All vulnerabilities in search

    News

    All products by Realobjects