Apache XML Graphics FOP unsafe deserialization in hyphenation loading (CVE-2026-71395)
Original title: CVE-2026-71395: Apache XML Graphics FOP: CWE-502 unsafe deserialization in hyphenation loading
Apache rates the flaw moderate; the notice gives no affected versions, fix, or exploitation status.
Simon Steiner posted CVE-2026-71395 to oss-security on November 11. Apache XML Graphics FOP is affected by CWE-502 unsafe deserialization in hyphenation loading, rated moderate. The snippet links the project site, the CVE record, and Jira issue FOP-3332, without versions or a fix.
Unconfirmed: Affected versions, a fixed release, and whether the flaw is exploited are not stated.
- Severity is listed as moderate.
- The issue is tracked as Apache Jira FOP-3332.
- No affected or fixed versions appear in the notice.
Impact: Unsafe deserialization when loading hyphenation data
| Product | Affected |
|---|---|
| Apache XML Graphics FOP | — |
- CVEs
- CVE-2026-71395
- Vendors
- Apache
- Products
- XML Graphics FOP
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-71395 | Unsafe deserialization in Apache XML Graphics FOP hyphenation loading | — | — |
From the original article
Posted by Simon Steiner on Nov 11 Severity: moderate https://xmlgraphics. apache. org/ https://www.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.