Apache XML Graphics FOP unsafe deserialization in hyphenation loading (CVE-2026-71395)
Apache rates the flaw moderate; the notice gives no affected versions, fix, or exploitation status.
42
CVE-2026-71395
Unsafe deserialization in Apache XML Graphics FOP hyphenation loading
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache XML Graphics FOP through 2.11 unsafely deserializes data while loading hyphenation. Anyone who can supply or influence the hyphenation data FOP loads can trigger the flaw. The advisory does not state the resulting impact. Applications that embed FOP at or below 2.11 are affected.
What to do: Upgrade Apache XML Graphics FOP to 2.12, which fixes the hyphenation-loading deserialization issue.
| Product | Affected | Fixed in |
|---|---|---|
| Apache XML Graphics FOP | through 2.11 | 2.12 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: through 2.11. Users are recommended to upgrade to version 2.12, which fixes the issue.
- Weakness
- CWE-502