CVE-2024-28109

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-28109
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-28109.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-28109
Aliases
Published
2024-03-28T13:19:39Z
Modified
2026-08-12T15:15:09Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Potential XSLT injection vulnerability when using policy files
Details

veraPDF-library is a PDF/A validation library. Executing policy checks using custom schematron files invokes an XSL transformation that could lead to a remote code execution (RCE) vulnerability. This vulnerability is fixed in 1.24.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-91"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28109.json"
}
References

Affected packages

Git / github.com/verapdf/verapdf-library

Affected ranges

Type
GIT
Repo
https://github.com/verapdf/verapdf-library
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
614ffa477a2cf0819e4b0df1ab133610e0da25fb
Fixed
9386ecbe1a1d1fb9e886d19df28851ed07890d9f
Fixed
d5314cbdf4e058e0716f80dbdad2dbd8d96e6bfe
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.24.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

Other
b
b191
b192
b193
b194
b195
b196
b197
b198
b199
b200
b201
b203
b204
b205
b206
b208
b209
b210
b211
b212
b213
b214
b215
b216
b217
b218
b219
b220
b221
b222
b223
b225
b226
b227
b228
b229
b230
b35
b36
b37
b38
b39
b40
d
d0.*
d0.11.101
d0.11.102
d0.11.103
d0.11.105
d0.11.106
d0.11.107
d0.11.108
d0.11.109
d0.11.110
d0.11.111
d0.11.112
d0.11.113
d0.11.114
d0.11.115
d0.11.116
d0.11.117
d0.11.118
d0.11.119
d0.11.120
d0.11.121
d0.11.122
d0.11.123
d0.11.124
d0.11.125
d0.11.126
d0.11.127
d0.11.128
d0.11.129
d0.11.130
d0.11.131
d0.11.132
d0.11.133
d0.11.134
d0.11.135
d0.11.136
d0.11.137
d0.13.1
d0.13.10
d0.13.11
d0.13.12
d0.13.2
d0.13.3
d0.13.4
d0.13.5
d0.13.6
d0.13.7
d0.13.8
d0.13.9
d0.15.1
d0.15.10
d0.15.11
d0.15.12
d0.15.13
d0.15.14
d0.15.15
d0.15.16
d0.15.17
d0.15.2
d0.15.3
d0.15.4
d0.15.5
d0.15.6
d0.15.7
d0.15.8
d0.15.9
d0.17.1
d0.17.10
d0.17.11
d0.17.12
d0.17.13
d0.17.14
d0.17.15
d0.17.16
d0.17.17
d0.17.18
d0.17.19
d0.17.2
d0.17.20
d0.17.21
d0.17.3
d0.17.4
d0.17.5
d0.17.6
d0.17.7
d0.17.8
d0.17.9
d0.19.1
d0.19.2
d0.19.5
d0.19.6
d0.21.1
d0.21.2
d0.21.3
d0.21.4
d0.23.1
d0.23.2
d0.23.3
d0.23.4
d0.23.5
d0.23.6
d0.23.7
d0.25.1
d0.25.10
d0.25.11
d0.25.12
d0.25.13
d0.25.14
d0.25.15
d0.25.16
d0.25.17
d0.25.18
d0.25.19
d0.25.2
d0.25.20
d0.25.3
d0.25.4
d0.25.5
d0.25.6
d0.25.7
d0.25.8
d0.25.9
d0.27.1
d0.27.10
d0.27.11
d0.27.12
d0.27.13
d0.27.14
d0.27.15
d0.27.16
d0.27.17
d0.27.18
d0.27.19
d0.27.2
d0.27.20
d0.27.21
d0.27.22
d0.27.23
d0.27.24
d0.27.25
d0.27.3
d0.27.4
d0.27.5
d0.27.6
d0.27.7
d0.27.8
d0.27.9
d0.29.1
d0.29.3
d0.29.4
d0.29.5
d0.3.0
d0.3.10
d0.3.100
d0.3.101
d0.3.102
d0.3.103
d0.3.104
d0.3.105
d0.3.106
d0.3.107
d0.3.108
d0.3.109
d0.3.11
d0.3.110
d0.3.111
d0.3.112
d0.3.113
d0.3.114
d0.3.115
d0.3.116
d0.3.117
d0.3.118
d0.3.119
d0.3.12
d0.3.120
d0.3.121
d0.3.122
d0.3.123
d0.3.124
d0.3.125
d0.3.126
d0.3.127
d0.3.129
d0.3.13
d0.3.130
d0.3.131
d0.3.14
d0.3.15
d0.3.158
d0.3.159
d0.3.16
d0.3.160
d0.3.161
d0.3.162
d0.3.163
d0.3.164
d0.3.165
d0.3.166
d0.3.167
d0.3.168
d0.3.169
d0.3.17
d0.3.170
d0.3.171
d0.3.172
d0.3.173
d0.3.174
d0.3.175
d0.3.176
d0.3.177
d0.3.19
d0.3.2
d0.3.23
d0.3.24
d0.3.25
d0.3.26
d0.3.27
d0.3.3
d0.3.30
d0.3.31
d0.3.32
d0.3.33
d0.3.34
d0.3.35
d0.3.36
d0.3.37
d0.3.4
d0.3.40
d0.3.41
d0.3.42
d0.3.43
d0.3.44
d0.3.45
d0.3.46
d0.3.47
d0.3.48
d0.3.49
d0.3.5
d0.3.53
d0.3.57
d0.3.58
d0.3.59
d0.3.6
d0.3.60
d0.3.61
d0.3.62
d0.3.63
d0.3.64
d0.3.65
d0.3.66
d0.3.67
d0.3.68
d0.3.69
d0.3.7
d0.3.70
d0.3.71
d0.3.72
d0.3.73
d0.3.74
d0.3.75
d0.3.76
d0.3.77
d0.3.78
d0.3.79
d0.3.8
d0.3.80
d0.3.81
d0.3.82
d0.3.83
d0.3.84
d0.3.85
d0.3.86
d0.3.87
d0.3.88
d0.3.89
d0.3.9
d0.3.90
d0.3.91
d0.3.92
d0.3.93
d0.3.94
d0.3.95
d0.3.96
d0.3.97
d0.3.98
d0.3.99
d0.5.10
d0.5.11
d0.5.12
d0.5.13
d0.5.14
d0.5.15
d0.5.16
d0.5.17
d0.5.18
d0.5.19
d0.5.2
d0.5.20
d0.5.21
d0.5.22
d0.5.23
d0.5.24
d0.5.25
d0.5.26
d0.5.27
d0.5.28
d0.5.29
d0.5.3
d0.5.30
d0.5.31
d0.5.32
d0.5.33
d0.5.34
d0.5.35
d0.5.36
d0.5.37
d0.5.38
d0.5.39
d0.5.4
d0.5.40
d0.5.41
d0.5.42
d0.5.43
d0.5.44
d0.5.45
d0.5.46
d0.5.47
d0.5.49
d0.5.5
d0.5.50
d0.5.51
d0.5.52
d0.5.53
d0.5.54
d0.5.55
d0.5.56
d0.5.57
d0.5.58
d0.5.59
d0.5.6
d0.5.60
d0.5.61
d0.5.62
d0.5.63
d0.5.64
d0.5.65
d0.5.66
d0.5.67
d0.5.68
d0.5.69
d0.5.7
d0.5.70
d0.5.8
d0.5.9
d0.7.1
d0.7.10
d0.7.11
d0.7.12
d0.7.13
d0.7.14
d0.7.15
d0.7.16
d0.7.17
d0.7.18
d0.7.19
d0.7.2
d0.7.20
d0.7.21
d0.7.22
d0.7.23
d0.7.24
d0.7.25
d0.7.26
d0.7.27
d0.7.28
d0.7.29
d0.7.3
d0.7.30
d0.7.31
d0.7.32
d0.7.33
d0.7.34
d0.7.35
d0.7.36
d0.7.37
d0.7.38
d0.7.39
d0.7.4
d0.7.40
d0.7.41
d0.7.42
d0.7.43
d0.7.44
d0.7.45
d0.7.46
d0.7.47
d0.7.48
d0.7.49
d0.7.5
d0.7.50
d0.7.51
d0.7.52
d0.7.6
d0.7.7
d0.7.8
d0.7.9
d0.9.10
d0.9.11
d0.9.12
d0.9.13
d0.9.14
d0.9.15
d0.9.16
d0.9.17
d0.9.18
d0.9.2
d0.9.26
d0.9.27
d0.9.28
d0.9.29
d0.9.3
d0.9.30
d0.9.31
d0.9.32
d0.9.33
d0.9.34
d0.9.35
d0.9.36
d0.9.37
d0.9.38
d0.9.39
d0.9.4
d0.9.5
d0.9.6
d0.9.7
d0.9.9
d1.*
d1.1.1
d1.1.2
d1.1.3
d1.1.4
d1.1.5
d1.1.6
d1.1.7
d1.1.8
d1.1.9
d1.11.1
d1.11.2
d1.11.3
d1.11.4
d1.11.5
d1.11.6
d1.11.7
d1.11.8
d1.13.1
d1.13.10
d1.13.2
d1.13.3
d1.13.4
d1.13.5
d1.13.6
d1.13.7
d1.13.8
d1.13.9
d1.3.10
d1.3.11
d1.3.12
d1.3.13
d1.3.14
d1.3.15
d1.3.16
d1.3.17
d1.3.18
d1.3.19
d1.3.2
d1.3.20
d1.3.21
d1.3.22
d1.3.23
d1.3.24
d1.3.3
d1.3.4
d1.3.5
d1.3.6
d1.3.7
d1.3.8
d1.3.9
d1.5.1
d1.5.10
d1.5.11
d1.5.12
d1.5.13
d1.5.14
d1.5.15
d1.5.16
d1.5.17
d1.5.2
d1.5.3
d1.5.4
d1.5.5
d1.5.6
d1.5.7
d1.5.8
d1.5.9
d1.7.1
d1.7.10
d1.7.11
d1.7.12
d1.7.13
d1.7.14
d1.7.15
d1.7.16
d1.7.17
d1.7.2
d1.7.20
d1.7.21
d1.7.22
d1.7.23
d1.7.24
d1.7.25
d1.7.26
d1.7.27
d1.7.28
d1.7.29
d1.7.3
d1.7.30
d1.7.31
d1.7.32
d1.7.33
d1.7.34
d1.7.35
d1.7.36
d1.7.37
d1.7.4
d1.7.5
d1.7.6
d1.7.7
d1.7.8
d1.7.9
d1.9.1
d1.9.10
d1.9.11
d1.9.12
d1.9.13
d1.9.14
d1.9.2
d1.9.3
d1.9.4
d1.9.5
d1.9.6
d1.9.7
d1.9.8
d1.9.9
jakarta-v1.*
jakarta-v1.23.10
jakarta-v1.23.11
jakarta-v1.23.12
jakarta-v1.23.13
jakarta-v1.23.14
jakarta-v1.23.15
jakarta-v1.23.16
jakarta-v1.23.17
jakarta-v1.23.18
jakarta-v1.23.19
jakarta-v1.23.20
jakarta-v1.23.21
jakarta-v1.23.22
jakarta-v1.23.23
jakarta-v1.23.3
jakarta-v1.23.4
jakarta-v1.23.5
jakarta-v1.23.6
jakarta-v1.23.7
jakarta-v1.23.8
jakarta-v1.23.9
jakarta-v1.25.1
jakarta-v1.25.10
jakarta-v1.25.100
jakarta-v1.25.101
jakarta-v1.25.102
jakarta-v1.25.103
jakarta-v1.25.104
jakarta-v1.25.105
jakarta-v1.25.106
jakarta-v1.25.107
jakarta-v1.25.108
jakarta-v1.25.109
jakarta-v1.25.11
jakarta-v1.25.110
jakarta-v1.25.111
jakarta-v1.25.112
jakarta-v1.25.113
jakarta-v1.25.114
jakarta-v1.25.115
jakarta-v1.25.116
jakarta-v1.25.117
jakarta-v1.25.118
jakarta-v1.25.119
jakarta-v1.25.12
jakarta-v1.25.120
jakarta-v1.25.121
jakarta-v1.25.123
jakarta-v1.25.124
jakarta-v1.25.125
jakarta-v1.25.126
jakarta-v1.25.13
jakarta-v1.25.14
jakarta-v1.25.15
jakarta-v1.25.16
jakarta-v1.25.17
jakarta-v1.25.2
jakarta-v1.25.20
jakarta-v1.25.21
jakarta-v1.25.22
jakarta-v1.25.23
jakarta-v1.25.24
jakarta-v1.25.25
jakarta-v1.25.26
jakarta-v1.25.27
jakarta-v1.25.29
jakarta-v1.25.3
jakarta-v1.25.30
jakarta-v1.25.31
jakarta-v1.25.32
jakarta-v1.25.33
jakarta-v1.25.34
jakarta-v1.25.35
jakarta-v1.25.37
jakarta-v1.25.38
jakarta-v1.25.4
jakarta-v1.25.40
jakarta-v1.25.41
jakarta-v1.25.42
jakarta-v1.25.43
jakarta-v1.25.44
jakarta-v1.25.45
jakarta-v1.25.46
jakarta-v1.25.47
jakarta-v1.25.48
jakarta-v1.25.49
jakarta-v1.25.5
jakarta-v1.25.50
jakarta-v1.25.51
jakarta-v1.25.52
jakarta-v1.25.53
jakarta-v1.25.54
jakarta-v1.25.55
jakarta-v1.25.56
jakarta-v1.25.57
jakarta-v1.25.58
jakarta-v1.25.59
jakarta-v1.25.6
jakarta-v1.25.60
jakarta-v1.25.61
jakarta-v1.25.62
jakarta-v1.25.63
jakarta-v1.25.64
jakarta-v1.25.65
jakarta-v1.25.66
jakarta-v1.25.67
jakarta-v1.25.68
jakarta-v1.25.69
jakarta-v1.25.7
jakarta-v1.25.70
jakarta-v1.25.71
jakarta-v1.25.72
jakarta-v1.25.73
jakarta-v1.25.74
jakarta-v1.25.75
jakarta-v1.25.76
jakarta-v1.25.77
jakarta-v1.25.78
jakarta-v1.25.79
jakarta-v1.25.8
jakarta-v1.25.80
jakarta-v1.25.81
jakarta-v1.25.82
jakarta-v1.25.83
jakarta-v1.25.84
jakarta-v1.25.85
jakarta-v1.25.86
jakarta-v1.25.87
jakarta-v1.25.88
jakarta-v1.25.89
jakarta-v1.25.9
jakarta-v1.25.90
jakarta-v1.25.91
jakarta-v1.25.92
jakarta-v1.25.93
jakarta-v1.25.94
jakarta-v1.25.95
jakarta-v1.25.96
jakarta-v1.25.97
jakarta-v1.25.98
jakarta-v1.25.99
jenkins-veraPDF-library-0.*
jenkins-veraPDF-library-0.11-1
jenkins-veraPDF-library-0.11-100
jenkins-veraPDF-library-0.11-101
jenkins-veraPDF-library-0.11-102
jenkins-veraPDF-library-0.11-103
jenkins-veraPDF-library-0.11-105
jenkins-veraPDF-library-0.11-106
jenkins-veraPDF-library-0.11-107
jenkins-veraPDF-library-0.11-108
jenkins-veraPDF-library-0.11-109
jenkins-veraPDF-library-0.11-110
jenkins-veraPDF-library-0.11-111
jenkins-veraPDF-library-0.11-112
jenkins-veraPDF-library-0.11-113
jenkins-veraPDF-library-0.11-114
jenkins-veraPDF-library-0.11-115
jenkins-veraPDF-library-0.11-116
jenkins-veraPDF-library-0.11-117
jenkins-veraPDF-library-0.11-118
jenkins-veraPDF-library-0.11-119
jenkins-veraPDF-library-0.11-120
jenkins-veraPDF-library-0.11-121
jenkins-veraPDF-library-0.11-122
jenkins-veraPDF-library-0.11-123
jenkins-veraPDF-library-0.11-124
jenkins-veraPDF-library-0.11-125
jenkins-veraPDF-library-0.11-126
jenkins-veraPDF-library-0.11-127
jenkins-veraPDF-library-0.11-128
jenkins-veraPDF-library-0.11-129
jenkins-veraPDF-library-0.11-130
jenkins-veraPDF-library-0.11-131
jenkins-veraPDF-library-0.11-132
jenkins-veraPDF-library-0.11-133
jenkins-veraPDF-library-0.11-134
jenkins-veraPDF-library-0.11-135
jenkins-veraPDF-library-0.11-136
jenkins-veraPDF-library-0.11-137
jenkins-veraPDF-library-0.11-2
jenkins-veraPDF-library-0.11-3
jenkins-veraPDF-library-0.11-4
jenkins-veraPDF-library-0.11-5
jenkins-veraPDF-library-0.11-6
jenkins-veraPDF-library-0.11-7
jenkins-veraPDF-library-0.11-8
jenkins-veraPDF-library-0.13-1
jenkins-veraPDF-library-0.13-10
jenkins-veraPDF-library-0.13-11
jenkins-veraPDF-library-0.13-12
jenkins-veraPDF-library-0.13-2
jenkins-veraPDF-library-0.13-3
jenkins-veraPDF-library-0.13-4
jenkins-veraPDF-library-0.13-5
jenkins-veraPDF-library-0.13-6
jenkins-veraPDF-library-0.13-7
jenkins-veraPDF-library-0.13-8
jenkins-veraPDF-library-0.13-9
jenkins-veraPDF-library-0.15-1
jenkins-veraPDF-library-0.15-2
jenkins-veraPDF-library-0.15-3
jenkins-veraPDF-library-0.15-4
jenkins-veraPDF-library-0.15-5
jenkins-veraPDF-library-0.15-6
jenkins-veraPDF-library-0.15-7
v0.*
v0.11.100
v0.11.5
v0.11.6
v0.11.7
v0.11.8
v1.*
v1.13.11
v1.15.10
v1.15.11
v1.15.12
v1.15.13
v1.15.14
v1.15.15
v1.15.17
v1.15.19
v1.15.2
v1.15.20
v1.15.3
v1.15.4
v1.15.7
v1.15.8
v1.15.9
v1.17.1
v1.17.10
v1.17.11
v1.17.12
v1.17.13
v1.17.14
v1.17.15
v1.17.16
v1.17.18
v1.17.2
v1.17.20
v1.17.21
v1.17.22
v1.17.23
v1.17.24
v1.17.25
v1.17.26
v1.17.27
v1.17.28
v1.17.29
v1.17.30
v1.17.31
v1.17.32
v1.17.33
v1.17.34
v1.17.4
v1.17.5
v1.17.6
v1.17.7
v1.17.8
v1.17.9
v1.19.1
v1.19.10
v1.19.11
v1.19.12
v1.19.13
v1.19.14
v1.19.15
v1.19.16
v1.19.17
v1.19.18
v1.19.19
v1.19.2
v1.19.20
v1.19.21
v1.19.22
v1.19.23
v1.19.24
v1.19.25
v1.19.26
v1.19.27
v1.19.28
v1.19.29
v1.19.3
v1.19.30
v1.19.31
v1.19.32
v1.19.34
v1.19.35
v1.19.36
v1.19.37
v1.19.38
v1.19.39
v1.19.4
v1.19.40
v1.19.41
v1.19.42
v1.19.43
v1.19.44
v1.19.45
v1.19.46
v1.19.47
v1.19.48
v1.19.49
v1.19.5
v1.19.50
v1.19.51
v1.19.52
v1.19.53
v1.19.54
v1.19.55
v1.19.56
v1.19.57
v1.19.58
v1.19.59
v1.19.6
v1.19.60
v1.19.61
v1.19.62
v1.19.63
v1.19.64
v1.19.65
v1.19.66
v1.19.67
v1.19.8
v1.19.9
v1.21.1
v1.21.10
v1.21.11
v1.21.12
v1.21.13
v1.21.14
v1.21.15
v1.21.16
v1.21.17
v1.21.18
v1.21.19
v1.21.2
v1.21.20
v1.21.21
v1.21.22
v1.21.23
v1.21.24
v1.21.25
v1.21.26
v1.21.27
v1.21.28
v1.21.29
v1.21.3
v1.21.30
v1.21.31
v1.21.32
v1.21.33
v1.21.34
v1.21.35
v1.21.36
v1.21.37
v1.21.38
v1.21.4
v1.21.40
v1.21.41
v1.21.42
v1.21.43
v1.21.44
v1.21.45
v1.21.46
v1.21.47
v1.21.48
v1.21.49
v1.21.5
v1.21.50
v1.21.51
v1.21.52
v1.21.53
v1.21.54
v1.21.55
v1.21.56
v1.21.57
v1.21.58
v1.21.59
v1.21.6
v1.21.60
v1.21.61
v1.21.62
v1.21.63
v1.21.64
v1.21.65
v1.21.66
v1.21.67
v1.21.68
v1.21.69
v1.21.7
v1.21.8
v1.21.9
v1.23.1
v1.23.11
v1.23.12
v1.23.13
v1.23.14
v1.23.15
v1.23.17
v1.23.18
v1.23.19
v1.23.2
v1.23.20
v1.23.21
v1.23.22
v1.23.23
v1.23.24
v1.23.25
v1.23.26
v1.23.27
v1.23.28
v1.23.29
v1.23.3
v1.23.30
v1.23.31
v1.23.32
v1.23.33
v1.23.34
v1.23.35
v1.23.36
v1.23.37
v1.23.38
v1.23.39
v1.23.4
v1.23.40
v1.23.41
v1.23.42
v1.23.43
v1.23.44
v1.23.45
v1.23.46
v1.23.47
v1.23.48
v1.23.49
v1.23.5
v1.23.50
v1.23.51
v1.23.52
v1.23.53
v1.23.54
v1.23.55
v1.23.56
v1.23.57
v1.23.58
v1.23.59
v1.23.6
v1.23.60
v1.23.61
v1.23.62
v1.23.63
v1.23.64
v1.23.65
v1.23.66
v1.23.67
v1.23.68
v1.23.69
v1.23.7
v1.23.70
v1.23.71
v1.23.72
v1.23.73
v1.23.74
v1.23.75
v1.23.76
v1.23.77
v1.23.78
v1.23.8
v1.23.9
v1.24.0-RC3
v1.24.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-28109.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "314024327165131025719359155641703627087",
                "153485509858851554164757819449810500174",
                "99671310537622811683114623434531180964",
                "278856627166843397374098825868273035592",
                "94024315187233117371038954304987097606",
                "210061705809035425765263114453671632579",
                "68401101661147721262409273196762375016",
                "212316229998943900538346054529279408659",
                "238550609166701848284992526505467900221",
                "222855551540734671196943360343421868759"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-28109-048244ac",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/verapdf/verapdf-library/commit/614ffa477a2cf0819e4b0df1ab133610e0da25fb",
        "target": {
            "file": "core/src/main/java/org/verapdf/report/XsltTransformer.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "268683998414629180723732748748622305513",
                "119591689990737683571003116572876667123",
                "187676800969564451594197965115920989569",
                "35300549163924853715016977494395208438",
                "62996282052143551778693146473336732067",
                "171117875149592780770013649849266522941",
                "291129686413221401557573584285810766465",
                "51294317410852440387739527248317925622",
                "331572443359837211208562569655502027979",
                "278633796295322599799435761756724422205",
                "280475483913205191445270189836404478495",
                "19143992816076042554783378395417813080",
                "71556732225210992123856106987236315976",
                "47926749257026320571128998380282564336",
                "63322495910519561176566198227185058374",
                "173311566811786119005563662949687445652",
                "327405362290801411389378411944726164845",
                "150037681874916755940498665587320824001",
                "71619496410149669050877827210052272397",
                "248599257197480896120833193527092472669",
                "261200544252286114637012428144588156977"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-28109-1901f1a9",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/verapdf/verapdf-library/commit/9386ecbe1a1d1fb9e886d19df28851ed07890d9f",
        "target": {
            "file": "core/src/main/java/org/verapdf/policy/PolicyChecker.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "77615674395939447696874967233975857252",
            "length": 108
        },
        "id": "CVE-2024-28109-3680c86f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/verapdf/verapdf-library/commit/614ffa477a2cf0819e4b0df1ab133610e0da25fb",
        "target": {
            "file": "core/src/main/java/org/verapdf/policy/SchematronPipeline.java",
            "function": "getTransformerFactory"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "150317643317009352837117710604998262747",
                "214179411249400868788326571793686841881",
                "160984633692644176330551112412516940355",
                "26278904556754478588255982403436883831",
                "51294317410852440387739527248317925622",
                "331572443359837211208562569655502027979",
                "263445317352147022175209384741336631021",
                "241848016587936372745676223628315048679",
                "300729532900850626314738368004229010849",
                "117424439969381308488465584479579394093",
                "191206354664775270332048757424204602670",
                "55768189952811248206539825698066730744",
                "165860902596739093650826672912782776156",
                "135630607161910714903073014893185802371"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-28109-4c544204",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/verapdf/verapdf-library/commit/9386ecbe1a1d1fb9e886d19df28851ed07890d9f",
        "target": {
            "file": "core/src/main/java/org/verapdf/report/XsltTransformer.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "224328017688963579429047543276332622691",
                "253495606006731938297965456417576031596",
                "208107536836371313768515420362726076099",
                "240578709705639387227594024464916772965",
                "94024315187233117371038954304987097606",
                "225769169320645258892164601130407247295",
                "64794483530284407491848938715549914885",
                "272800470640206410122280763977004664587",
                "156932971524137884292793579576906935401",
                "107189704998523357392636661063618605730",
                "119601254455757965076760477389806806194",
                "138166216149321281900164122458489691970",
                "11943939343719906000813310495673874763",
                "35300549163924853715016977494395208438",
                "248599257197480896120833193527092472669",
                "261200544252286114637012428144588156977"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-28109-68d8a46e",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/verapdf/verapdf-library/commit/d5314cbdf4e058e0716f80dbdad2dbd8d96e6bfe",
        "target": {
            "file": "core/src/main/java/org/verapdf/policy/PolicyChecker.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "11739690271018724119678102136666513982",
                "201483171779504168798728696500956372650",
                "283179104122216186589824824090771591881",
                "51294317410852440387739527248317925622",
                "331572443359837211208562569655502027979",
                "278633796295322599799435761756724422205",
                "280475483913205191445270189836404478495",
                "19143992816076042554783378395417813080",
                "108589293031235403974938081119048647762",
                "262339945258243056238408127486317543030",
                "29916690645094876781074380477457350424",
                "218387017017241573863496324558489609758",
                "315380829231234721679759831500944156725",
                "300508137327936713773502709470718543695",
                "107575698714835447749587793724562227032"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-28109-6ad6318e",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/verapdf/verapdf-library/commit/9386ecbe1a1d1fb9e886d19df28851ed07890d9f",
        "target": {
            "file": "core/src/main/java/org/verapdf/policy/SchematronPipeline.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "258197942930372520807232347724110843674",
                "321517328457344202773345465738423935872",
                "55691878878564924380722908300775341661",
                "128811363057000024621762920757818299371",
                "104857820877417341818050995754102403058",
                "8321216550991638146802355065206854513",
                "219084297865345889781102667887985017606",
                "160141410629888383393745805002316015544",
                "63386078023871736704282743553485838731",
                "4654243613873196762169853584461005995",
                "243272454754186338166362573584960041911",
                "321699211789779336595589911859547959141",
                "276631690930558555844825754640543527160"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-28109-76bb3aac",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/verapdf/verapdf-library/commit/614ffa477a2cf0819e4b0df1ab133610e0da25fb",
        "target": {
            "file": "core/src/main/java/org/verapdf/policy/SchematronPipeline.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "314024327165131025719359155641703627087",
                "153485509858851554164757819449810500174",
                "99671310537622811683114623434531180964",
                "278856627166843397374098825868273035592",
                "94024315187233117371038954304987097606",
                "68401101661147721262409273196762375016",
                "212316229998943900538346054529279408659",
                "238550609166701848284992526505467900221",
                "222855551540734671196943360343421868759",
                "165860902596739093650826672912782776156",
                "135630607161910714903073014893185802371"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-28109-858db0b5",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/verapdf/verapdf-library/commit/d5314cbdf4e058e0716f80dbdad2dbd8d96e6bfe",
        "target": {
            "file": "core/src/main/java/org/verapdf/report/XsltTransformer.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "258197942930372520807232347724110843674",
                "321517328457344202773345465738423935872",
                "55691878878564924380722908300775341661",
                "128811363057000024621762920757818299371",
                "104857820877417341818050995754102403058",
                "8321216550991638146802355065206854513",
                "4654243613873196762169853584461005995",
                "243272454754186338166362573584960041911",
                "321699211789779336595589911859547959141",
                "276631690930558555844825754640543527160"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-28109-939a9246",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/verapdf/verapdf-library/commit/d5314cbdf4e058e0716f80dbdad2dbd8d96e6bfe",
        "target": {
            "file": "core/src/main/java/org/verapdf/policy/SchematronPipeline.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "55445795179364619816085416989741324585",
            "length": 313
        },
        "id": "CVE-2024-28109-b5ed2f8b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/verapdf/verapdf-library/commit/9386ecbe1a1d1fb9e886d19df28851ed07890d9f",
        "target": {
            "file": "core/src/main/java/org/verapdf/policy/SchematronPipeline.java",
            "function": "getTransformerFactory"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "77615674395939447696874967233975857252",
            "length": 108
        },
        "id": "CVE-2024-28109-dc4351d9",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/verapdf/verapdf-library/commit/d5314cbdf4e058e0716f80dbdad2dbd8d96e6bfe",
        "target": {
            "file": "core/src/main/java/org/verapdf/policy/SchematronPipeline.java",
            "function": "getTransformerFactory"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "41089638787531240438109833714202719064",
            "length": 383
        },
        "id": "CVE-2024-28109-e29c38e8",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/verapdf/verapdf-library/commit/9386ecbe1a1d1fb9e886d19df28851ed07890d9f",
        "target": {
            "file": "core/src/main/java/org/verapdf/policy/PolicyChecker.java",
            "function": "insertPolicyReport"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "224328017688963579429047543276332622691",
                "253495606006731938297965456417576031596",
                "208107536836371313768515420362726076099",
                "240578709705639387227594024464916772965",
                "94024315187233117371038954304987097606",
                "225769169320645258892164601130407247295",
                "64794483530284407491848938715549914885",
                "272800470640206410122280763977004664587",
                "156932971524137884292793579576906935401",
                "107189704998523357392636661063618605730",
                "119601254455757965076760477389806806194",
                "138166216149321281900164122458489691970",
                "11943939343719906000813310495673874763",
                "236982991262185234966901048780122358035",
                "52345285324363004965078444182254192372",
                "246295016927105974677660352155156870845"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-28109-f8b00b77",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/verapdf/verapdf-library/commit/614ffa477a2cf0819e4b0df1ab133610e0da25fb",
        "target": {
            "file": "core/src/main/java/org/verapdf/policy/PolicyChecker.java"
        }
    }
]
vanir_signatures_modified 
"2026-08-12T15:15:09Z"