CVE-2024-22641: 
Linux Debian vulnerability analysis and mitigation

TCPDF version 6.6.5 and earlier versions are vulnerable to a Regular Expression Denial of Service (ReDoS) vulnerability when parsing untrusted SVG files. The vulnerability is tracked as CVE-2024-22641 and was discovered in early 2024 (NVD).

The vulnerability occurs during the SVG file parsing process in TCPDF. When processing untrusted SVG files, the application's regular expression pattern matching can be exploited to trigger excessive backtracking, leading to a ReDoS condition. This is confirmed by checking with preg_last_error() after the vulnerable code execution, which returns PREG_BACKTRACK_LIMIT_ERROR (GitHub POC). The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability can cause a denial of service condition through excessive resource consumption during SVG file parsing. The attack specifically targets the application's regular expression processing capabilities, potentially making the service unresponsive (GitHub POC).

The vulnerability has been fixed in versions after 6.6.5. Users are advised to upgrade to the latest version of TCPDF to mitigate this security issue (NVD).