CVE-2026-71395: Apache XML Graphics FOP: CWE-502 unsafe deserialization in hyphenation loading

1 source · 8 articlesFirst reported Nov 11, 2026 · 17:04 UTCUpdated Nov 11, 2026 · 17:21 UTC (3h ago)

Merged summary · from the lead articleSummaries by Vani AI

Apache rates the flaw moderate; the notice gives no affected versions, fix, or exploitation status.

Simon Steiner posted CVE-2026-71395 to oss-security on November 11. Apache XML Graphics FOP is affected by CWE-502 unsafe deserialization in hyphenation loading, rated moderate. The snippet links the project site, the CVE record, and Jira issue FOP-3332, without versions or a fix.

Key facts

Severity is listed as moderate.
The issue is tracked as Apache Jira FOP-3332.
No affected or fixed versions appear in the notice.

Analyze CVE-2026-71395 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2026-71395 CVE-2026-49236 CVE-2026-44929 CVE-2026-89326 CVE-2026-90993 CVE-2026-40853 CVE-2026-126627 CVE-2026-111792

Vendors: Apache
Products: XML Graphics FOP Apache XML Graphics Batik Apache Batik

Coverage

oldest first · one row per article · UTC

17:04 UTC · 3h ago oss-securityFirst report
CVE-2026-111792: Apache XML Graphics Batik: Denial of Service via SVG Element Reference Resolution
17:07 UTC · 3h ago oss-security
CVE-2026-126627: Apache XML Graphics FOP: TemporaryFolder on unix-like systems does not limitaccess to created files
17:10 UTC · 3h ago oss-security
CVE-2026-40853: Apache XML Graphics Batik: Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFont
17:13 UTC · 3h ago oss-security
Apache Batik has a moderate SSRF flaw (CVE-2026-44929)
Simon Steiner posted the moderate-severity issue on November 11, with links to the CVE and BATIK-1393.
17:15 UTC · 3h ago oss-security
Batik SVG color-profile xml:base bypasses same-origin checks (CVE-2026-49236)
Apache rates the Batik external-resource bypass moderate; the oss-security note does not list versions or a fix.
17:17 UTC · 3h ago oss-security
Apache XML Graphics FOP unsafe deserialization in hyphenation loading (CVE-2026-71395)
Apache rates the flaw moderate; the notice gives no affected versions, fix, or exploitation status.
17:19 UTC · 3h ago oss-security
Apache Batik hardens SAXDocumentFactory validation (CVE-2026-90993)
Apache rates the issue moderate and cites BATIK-1399, with no versions, fix, or exploitation status.
17:21 UTC · 3h ago oss-security
Apache Batik must check URL protocol when loading documents (CVE-2026-89326)
Apache rates the XML Graphics Batik issue moderate; the notice lists no versions, fix, or exploitation.

Vulnerabilities in this story

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-111792 +7 related CVEs CVE-2026-126627 CVE-2026-40853 CVE-2026-44929 CVE-2026-49236 CVE-2026-71395 CVE-2026-89326 CVE-2026-90993	Uncontrolled recursion DoS in Apache Batik through 1.19	—	—		9h ago