Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-111792

Uncontrolled recursion DoS in Apache Batik through 1.19

CVSS
—
EPSS
—
Published
·
Modified
Analyze CVE-2026-111792 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

Apache XML Graphics Batik through 1.19 has uncontrolled recursion while resolving SVG element references. An attacker who supplies a crafted SVG can drive recursive reference resolution and cause denial of service in the process that renders it. Applications and services that parse untrusted SVG with Batik are affected.

What to do: Upgrade Apache XML Graphics Batik to 1.20, which fixes CVE-2026-111792.

ProductAffectedFixed in
Apache XML Graphics Batikthrough 1.191.20
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

Uncontrolled Recursion vulnerability in Apache XML Graphics Batik. This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.

Weakness
CWE-674
NVD CVE.org GitHub PoCs EPSS (—)

In the news

1 story