veraPDF vulnerabilities
We track 3 vulnerabilities in veraPDF products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on July 29, 2026.
Latest veraPDF vulnerabilities
- 8.7 High severity
veraPDF-validation: Improper Restriction of XML External Entity Reference
veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity (XXE) vulnerability in validation-model/src/main/java/org/verapdf/gf/mode
- 8.7 High severity
veraPDF-validation: Improper Restriction of XML External Entity Reference
veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity (XXE) vulnerability in validation-model/src/main/java/org/verapdf/gf/model/tools/Dictionary
- 8.1 High severity
veraPDF-library: XML Injection
veraPDF-library is a PDF/A validation library. Executing policy checks using custom schematron files invokes an XSL transformation that could lead to a remote code execution (RCE) vulnerability. This vulnerability is fixed in 1.24.2.