Apache Batik hardens SAXDocumentFactory validation (CVE-2026-90993)
Original title: CVE-2026-90993: Apache XML Graphics Batik: Harden validation in SAXDocumentFactory
Apache rates the issue moderate and cites BATIK-1399, with no versions, fix, or exploitation status.
Simon Steiner posted to oss-security on November 11 about CVE-2026-90993 in Apache XML Graphics Batik. The notice says validation in SAXDocumentFactory was hardened and lists the severity as moderate. It links JIRA issue BATIK-1399 and the project site but gives no further technical detail.
Unconfirmed: The snippet does not describe the flaw, affected versions, or whether a release fixes it.
- Apache rates CVE-2026-90993 moderate.
- The related tracker issue is BATIK-1399.
- The post names neither affected nor fixed versions.
| Product | Affected |
|---|---|
| Apache XML Graphics Batik | — |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-90993 | XXE in Apache XML Graphics Batik through 1.19 | — | — |
From the original article
Posted by Simon Steiner on Nov 11 Severity: moderate https://issues. apache. org/jira/browse/BATIK-1399 https://xmlgraphics.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.