The Apache® XML Graphics Project - Security
Published Vulnerabilities
The Apache® XML Graphics Project has collected its Security related information for all of its sub-projects to this page.
Apache Batik™ Project - Apache Batik Security
| CVE | Description | Severity | Fixed in | Affects | Issue Public | Released |
|---|---|---|---|---|---|---|
| CVE-2026-40853 | Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFont | medium | Batik 1.20 | 1.19 and earlier | 2026-10-20 | 2026-10-20 |
| CVE-2026-44929 | SSRF vulnerability | medium | Batik 1.20 | 1.19 and earlier | 2026-10-20 | 2026-10-20 |
| CVE-2026-49236 | SVG color-profile xml:base bypasses Batik external resource same-origin checks | medium | Batik 1.20 | 1.19 and earlier | 2026-10-20 | 2026-10-20 |
| CVE-2026-89326 | Check url protocol when loading document | medium | Batik 1.20 | 1.19 and earlier | 2026-10-20 | 2026-10-20 |
| CVE-2026-90993 | Harden validation in SAXDocumentFactory | medium | Batik 1.20 | 1.19 and earlier | 2026-10-20 | 2026-10-20 |
| CVE-2026-111791 | SSRF via Script Engine POST Request Interface | medium | Batik 1.20 | 1.19 and earlier | 2026-10-20 | 2026-10-20 |
| CVE-2026-111792 | Denial of Service via SVG Element Reference Resolution | medium | Batik 1.20 | 1.19 and earlier | 2026-10-20 | 2026-10-20 |
| CVE-2022-44729 | SSRF vulnerability | medium | Batik 1.17 | 2023-08-22 | 2023-08-22 | |
| CVE-2022-44730 | SSRF vulnerability | medium | Batik 1.17 | 2023-08-22 | 2023-08-22 | |
| CVE-2022-42890 | SSRF vulnerability | medium | Batik 1.16 | 2022-10-25 | 2022-10-25 | |
| CVE-2022-41704 | SSRF vulnerability | medium | Batik 1.16 | 2022-10-25 | 2022-10-25 | |
| CVE-2022-38398 | SSRF vulnerability | medium | Batik 1.15 | 2022-09-22 | 2022-09-22 | |
| CVE-2022-38648 | SSRF vulnerability | medium | Batik 1.15 | 2022-09-22 | 2022-09-22 | |
| CVE-2022-40146 | SSRF vulnerability | medium | Batik 1.15 | 2022-09-22 | 2022-09-22 | |
| CVE-2020-11987 | SSRF vulnerability | medium | Batik 1.14 | 1.13 and earlier | 2021-02-24 | 2021-01-20 |
| CVE-2019-17566 | SSRF vulnerability | medium | Batik 1.13 | 1.12 and earlier | 2020-06-15 | 2020-05-13 |
| CVE-2018-8013 | Deserialization vulnerability | medium | Batik 1.10 | 1.9.1 and earlier | 2018-05-23 | 2018-05-23 |
| CVE-2017-5662 | XXE vulnerability | medium | Batik 1.9 | 1.8 and earlier | 2017-04-18 | 2017-04-10 |
| CVE-2015-0250 | XXE vulnerability | medium | Batik 1.8, 1.7.1 and 1.6.1 | 1.7, 1.6 and earlier | 2012-07-25 | 2015-03-17 (Batik 1.8) and 2015-05-10 (Batik 1.7.1 and 1.6.1) |
Apache FOP™ Project - Apache FOP Security
| CVE | Description | Severity | Fixed in | Affects | Issue Public | Released |
|---|---|---|---|---|---|---|
| CVE-2026-71395 | CWE-502 unsafe deserialization in hyphenation loading | medium | FOP 2.12 | 2.11 and earlier | 2026-10-20 | 2026-10-20 |
| CVE-2024-28168 | XXE vulnerability | medium | FOP 2.10 | 2024-10-9 | 2024-10-9 | |
| CVE-2017-5661 | XXE vulnerability | medium | FOP 2.2 | 2.1 and earlier | 2017-04-18 | 2017-04-10 |
Apache® XML Graphics Commons Project - Apache XML Graphics Commons Security
| CVE | Description | Severity | Fixed in | Affects | Issue Public | Released |
|---|---|---|---|---|---|---|
| CVE-2020-11988 | XXE vulnerability | medium | Commons 2.6 | 2.4 and earlier | 2021-02-24 | 2021-01-20 |
Reporting New Security Problems with the Apache XML Graphics Sub Projects
Please report problems to the private security mailing list of the ASF Security Team, before disclosing them in a public forum. See the page of the ASF Security Team for further information and contact information.
IMPORTANT
- The ASF Security Team cannot accept regular bug reports or other queries. We ask that you use our bug reporting page for those.
- All mail sent to the Security Team that does not relate to security problems in Apache software will be ignored.
VERY IMPORTANT
- Do not submit security reports regarding vulnerabilities to our bug reporting system. This may inadvertently publicize the security vulnerability. Instead follow the steps on the ASF Security Page.
Security Standards
Apache XML Graphics Project vulnerabilities are labeled with CVE (Common Vulnerabilities and Exposures) identifiers.