CVE-2024-22640

What it actually does

The flaw permits catastrophic backtracking in a regular expression during color parsing of untrusted HTML, resulting in excessive CPU consumption and potential denial of service.

Why it matters to the business

Services that convert user-supplied HTML into PDFs can become slow or unavailable, interrupting document generation workflows and increasing infrastructure load.

How an attack unfolds

An attacker supplies an HTML document containing a maliciously crafted color value to any application using the vulnerable library version; the color parser's regex engine enters prolonged backtracking, exhausting server resources without authentication or user interaction.

How to fix it

Upgrade TCPDF to the latest version greater than 6.6.5; if immediate upgrade is not possible, implement input sanitization to reject or normalize color values before parsing.

How to confirm the fix worked

Reproduce PDF generation using previously triggering color patterns and confirm processing completes within expected time bounds; review release notes for the resolved color regex.

Typical attack path

1. Locate an endpoint or feature that accepts HTML and invokes TCPDF for PDF rendering
2. Craft a color attribute containing a string engineered for regex backtracking
3. Submit the HTML payload through the normal input channel
4. Trigger repeated processing to sustain resource exhaustion

How to detect it

Review application and web server logs for PDF generation requests that exhibit abnormally long execution times or high CPU; correlate with incoming HTML containing unusual color strings.

What your security team should do

• Prioritize upgrade of the TCPDF library across all instances
• Add server-side validation to strip or limit color-related attributes in HTML input
• Enable request timeouts and resource limits on PDF generation processes
• Monitor EPSS and library advisories for any change in exploit maturity