CVE-2026-71395
Apache XML Graphics FOP: CWE-502 unsafe deserialization in hyphenation loading
unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOP.
This issue affects Apache XML Graphics FOP: through 2.11.
Users are recommended to upgrade to version 2.12, which fixes the issue.
Exploit likelihood
What each source reports
CVE ListNo score
Apache XML Graphics FOP: CWE-502 unsafe deserialization in hyphenation loading
unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOP.
This issue affects Apache XML Graphics FOP: through 2.11.
Users are recommended to upgrade to version 2.12, which fixes the issue.
- Record
CVE-2026-71395- Weakness
- CWE-502
- Updated
- 2026-11-11
EUVDEUVD-2026-123531No score
unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOP.
This issue affects Apache XML Graphics FOP: through 2.11.
Users are recommended to upgrade to version 2.12, which fixes the issue.
- Record
EUVD-2026-123531- Updated
- 2026-11-11
GitHub AdvisoriesGHSA-538h-76qv-3vqwNo score
unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOP. This...
unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOP.
This issue affects Apache XML Graphics FOP: through 2.11.
Users are recommended to upgrade to version 2.12, which fixes the issue.
- Record
GHSA-538h-76qv-3vqw- Weakness
- CWE-502
- Updated
- 2026-11-11
NVDNo score
unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOP.
This issue affects Apache XML Graphics FOP: through 2.11.
Users are recommended to upgrade to version 2.12, which fixes the issue.
- Record
CVE-2026-71395- Weakness
- CWE-502
- Updated
- 2026-11-11
OSVDEBIAN-CVE-2026-71395No score
unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: through 2.11. Users are recommended to upgrade to version 2.12, which fixes the issue.
- Record
DEBIAN-CVE-2026-71395- Updated
- 2026-11-12
OSVUBUNTU-CVE-2026-71395No score
unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: through 2.11. Users are recommended to upgrade to version 2.12, which fixes the issue.
- Record
UBUNTU-CVE-2026-71395- Updated
- 2026-11-13
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
fopDebian:12 | All versions, plus listed versions 1:2.10+dfsg-11:2.10+dfsg-1~exp01:2.10+dfsg-1~exp11:2.10+dfsg-21:2.10+dfsg1-1 Show 5 moreShow less1:2.10+dfsg1-21:2.10+dfsg1-31:2.10+dfsg1-41:2.8-21:2.8-3 | None known |
fopDebian:13 | All versions, plus listed versions 1:2.10+dfsg-21:2.10+dfsg1-11:2.10+dfsg1-21:2.10+dfsg1-31:2.10+dfsg1-4 | None known |
fopDebian:14 | All versions, plus listed versions 1:2.10+dfsg-21:2.10+dfsg1-11:2.10+dfsg1-21:2.10+dfsg1-31:2.10+dfsg1-4 | None known |
fopUbuntu:16.04:LTS | All versions, plus listed versions 1:1.1.dfsg2-1ubuntu11:2.1-2 | None known |
fopUbuntu:18.04:LTS | All versions, plus listed versions 1:2.1-7 | None known |
fopUbuntu:20.04:LTS | All versions, plus listed versions 1:2.3-21:2.4-2 | None known |
fopUbuntu:22.04:LTS | All versions, plus listed versions 1:2.5-31:2.6-11:2.6-2 | None known |
fopUbuntu:24.04:LTS | All versions, plus listed versions 1:2.8-21:2.8-3 | None known |
fopUbuntu:26.10 | All versions, plus listed versions 1:2.10+dfsg-2 | None known |
fopUbuntu:26.04:LTS | All versions, plus listed versions 1:2.10+dfsg-2 | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected, aliases, references | GitHub Advisories, OSV | |
| references | CVE List | |
| references | NVD | |
| published | EUVD, NVD | |
| aliases | EUVD | |
| aliases, references | GitHub Advisories | |
| first indexed | CVE List |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-71395 is a vulnerability with no CVSS score yet in Apache Software Foundation Xml Graphics Fop, published November 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 30th percentile. No source names a fixed version.
References
issues.apache.org/jira/browse/FOP-3332
lists.apache.org/thread.html/nsb89to1r0vzdh3t4w7x10q4z3xk5jqf
openwall.com/lists/oss-security/2026/11/11/19
nvd.nist.gov/vuln/detail/CVE-2026-71395
github.com/advisories/GHSA-538h-76qv-3vqw
security-tracker.debian.org/tracker/CVE-2026-71395
ubuntu.com/security/CVE-2026-71395
cve.org/CVERecord?id=CVE-2026-71395