CVE-2024-56521: TCPDF missing certificate validation

December 27, 2024 (updated October 31, 2025)

An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are set unsafely.

References

github.com/advisories/GHSA-9mgx-552f-59p6
github.com/tecnickcom/TCPDF
github.com/tecnickcom/TCPDF/commit/aab43ab0a824e956276141a28a24c7c0be20f554
github.com/tecnickcom/TCPDF/compare/6.7.8...6.8.0
nvd.nist.gov/vuln/detail/CVE-2024-56521
tcpdf.org/

Code Behaviors & Features

Detect and mitigate CVE-2024-56521 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →