CVE-2024-22640: TCPDF ReDoS Vulnerability via HTML Parsing

CVE-2024-22640 Overview

CVE-2024-22640 is a Regular Expression Denial of Service (ReDoS) vulnerability affecting TCPDF versions <=6.6.5. TCPDF is a widely deployed PHP library used to generate PDF documents from HTML and other inputs. The flaw resides in the HTML color parsing routines, where a crafted color value forces the underlying regular expression into catastrophic backtracking. Applications that pass untrusted HTML to TCPDF can be stalled by a single malicious request, exhausting CPU resources on the server. The vulnerability is tracked under [CWE-1333: Inefficient Regular Expression Complexity] and has been addressed in downstream distributions including Fedora and Debian LTS.

Critical Impact
A remote, unauthenticated attacker can trigger sustained CPU exhaustion in any web application that renders attacker-supplied HTML through TCPDF, causing denial of service.

Affected Products

TCPDF versions <=6.6.5 (tcpdf_project:tcpdf)
Fedora 40 (fedoraproject:fedora)
Debian LTS distributions shipping vulnerable TCPDF packages

Discovery Timeline

2024-04-19 - CVE-2024-22640 published to the National Vulnerability Database (NVD)
2025-06 - Debian LTS issues security notice for affected TCPDF packages
2025-11-04 - NVD record last modified

Technical Details for CVE-2024-22640

Vulnerability Analysis

The flaw is a classic Regular Expression Denial of Service (ReDoS) condition. TCPDF parses inline HTML styling, including CSS color values such as rgb(...), rgba(...), hsl(...), and named colors. The regular expressions used to validate and decompose these color values contain ambiguous quantifiers that permit catastrophic backtracking when fed a carefully constructed input string.

When the PHP PCRE engine evaluates the malicious color value, it explores an exponential number of match permutations before failing. A request that would normally complete in milliseconds instead consumes the PHP worker for seconds or minutes. Because TCPDF is commonly invoked synchronously inside HTTP request handlers, a small number of concurrent requests can saturate the available PHP-FPM workers and render the application unresponsive.

The vulnerability does not corrupt memory or expose data. It targets availability only, which is reflected in the impact subscore showing no confidentiality or integrity loss.

Root Cause

The root cause is inefficient regular expression complexity [CWE-1333] in TCPDF's HTML color handling logic. The patterns lack atomic grouping or possessive quantifiers and allow overlapping repetition, which permits catastrophic backtracking when an attacker submits a non-matching string that approximates a valid color syntax.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. Any endpoint that converts untrusted HTML to PDF using TCPDF is exposed. Typical exposure points include invoice generators, report exporters, ticket printers, and any feature that renders user-submitted rich text. The attacker submits HTML containing a crafted style attribute or inline color value, and TCPDF's parser enters the pathological regex evaluation.

Reference proof-of-concept material is available at the CVE-2024-22640 PoC Repository and the upstream TCPDF GitHub Repository.

Detection Methods for CVE-2024-22640

Indicators of Compromise

PHP-FPM or Apache worker processes consuming 100% CPU for unusually long durations during PDF generation requests
HTTP requests to PDF generation endpoints containing malformed or oversized color, bgcolor, or CSS style attributes
Spikes in request latency or HTTP 504 gateway timeouts on routes that invoke TCPDF
Repeated requests from a single source IP targeting PDF export functionality

Detection Strategies

Inventory all PHP applications and identify those bundling TCPDF at version <=6.6.5 using composer manifests or filesystem scans
Instrument PDF generation endpoints with execution-time metrics and alert when individual requests exceed expected thresholds
Deploy web application firewall rules that inspect HTML payloads sent to PDF endpoints for anomalously long color strings or repeated character classes

Monitoring Recommendations

Track PHP request duration percentiles for endpoints that invoke TCPDF and alert on sustained increases
Monitor system CPU utilization on PDF rendering hosts and correlate spikes with inbound request logs
Forward web server access logs to a centralized analytics platform for pattern analysis of repeated slow requests

How to Mitigate CVE-2024-22640

Immediate Actions Required

Upgrade TCPDF to a fixed version supplied by your distribution or by the upstream TCPDF GitHub Repository
Apply distribution patches via the Fedora Package Announcement or the Debian LTS Security Notice
Enforce strict execution time limits on PHP workers handling PDF generation using max_execution_time and PHP-FPM request_terminate_timeout
Restrict PDF generation endpoints behind authentication and rate limiting

Patch Information

Fixes are available through Fedora and Debian LTS package updates referenced in the vendor advisories above. Operators using Composer should update the tecnickcom/tcpdf dependency to a patched release and redeploy affected applications. Verify the installed version after deployment to confirm the upgrade.

Workarounds

Sanitize or strip CSS style, color, and bgcolor attributes from untrusted HTML before passing it to TCPDF
Run TCPDF inside a sandboxed worker process with a hard CPU time budget enforced by ulimit or systemd resource controls
Move PDF generation to an asynchronous job queue so a stalled render does not consume web-tier capacity
Apply rate limiting and request size caps at the reverse proxy for endpoints that accept HTML for PDF conversion

bash

# Example PHP-FPM and PHP CLI hardening for TCPDF workloads
# /etc/php/8.x/fpm/pool.d/www.conf
request_terminate_timeout = 10s

# /etc/php/8.x/fpm/php.ini
max_execution_time = 10
pcre.backtrack_limit = 100000
pcre.recursion_limit = 100000

# Update TCPDF via Composer
composer update tecnickcom/tcpdf