{"id":"CVE-2018-8013","aliases":["CLSA-2026-1778633124","DEBIAN-CVE-2018-8013","DLA-1385-1","DSA-4215-1","EUVD-2022-1909","GHSA-25gw-4pcc-45cf","UBUNTU-CVE-2018-8013","USN-3661-1"],"status":"published","title":"Deserialization of Untrusted Data in Apache Batik","description":"In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.18591,"percentile":0.97276,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502"],"published":"2018-05-23T00:00:00Z","modified":"2026-10-24T10:30:27Z","fixes":[{"ecosystem":"Maven","package":"org.apache.xmlgraphics:batik","fixed_in":["1.10"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"batik","fixed_in":["1.10-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"batik","fixed_in":["1.10-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"batik","fixed_in":["1.10-1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"batik","fixed_in":["1.7+dfsg-3+deb7u3"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"batik","fixed_in":["1.7.ubuntu-8ubuntu2.14.04.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.xmlgraphics:batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0"},{"last_affected":"1.9.1"},{"fixed":"1.10"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-anim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-awt-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-css","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-dom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-ext","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-extension","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-extensions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-gui-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-gvt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-rasterizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-rasterizer-ext","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-script","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-slideshow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-squiggle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-squiggle-ext","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-svg-dom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-svggen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-svgpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-swing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-transcoder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-ttf2svg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"Debian:12","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7+dfsg-3+deb7u3"}]}],"versions":["1.7+dfsg-3","1.7+dfsg-3+deb7u1","1.7+dfsg-3+deb7u2"]},{"source":"osv","ecosystem":"Debian:8","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7+dfsg-5+deb8u1"}]}],"versions":["1.7+dfsg-5"],"bundled":2},{"source":"osv","ecosystem":"Debian:9","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8-4+deb9u1"}]}],"versions":["1.8-4"],"bundled":2},{"source":"osv","ecosystem":"Maven","package":"org.apache.xmlgraphics:batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0"},{"fixed":"1.10"}]}],"versions":["1.9.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.ubuntu-8ubuntu2.14.04.3"}]}],"versions":["1.7.ubuntu-8ubuntu2","1.7.ubuntu-8ubuntu2.14.04.1","1.7.ubuntu-8ubuntu2.14.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.ubuntu-8ubuntu3","1.8-3","1.8-3ubuntu1","1.8-3ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.ubuntu-8ubuntu2.14.04.3"}]}],"versions":["1.7.ubuntu-8ubuntu2","1.7.ubuntu-8ubuntu2.14.04.1","1.7.ubuntu-8ubuntu2.14.04.2"]}],"products":[{"vendor":"apache","product":"batik"},{"vendor":"apache software foundation","product":"apache batik"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"oracle","product":"business_intelligence"},{"vendor":"oracle","product":"communications_diameter_signaling_router"},{"vendor":"oracle","product":"communications_metasolv_solution"},{"vendor":"oracle","product":"communications_webrtc_session_controller"},{"vendor":"oracle","product":"data_integrator"},{"vendor":"oracle","product":"enterprise_repository"},{"vendor":"oracle","product":"financial_services_analytical_applications_infrastructure"},{"vendor":"oracle","product":"fusion_middleware_mapviewer"},{"vendor":"oracle","product":"instantis_enterprisetrack"},{"vendor":"oracle","product":"insurance_calculation_engine"},{"vendor":"oracle","product":"insurance_policy_administration_j2ee"},{"vendor":"oracle","product":"jd_edwards_enterpriseone_tools"},{"vendor":"oracle","product":"retail_back_office"},{"vendor":"oracle","product":"retail_central_office"},{"vendor":"oracle","product":"retail_integration_bus"},{"vendor":"oracle","product":"retail_order_broker"},{"vendor":"oracle","product":"retail_point-of-service"},{"vendor":"oracle","product":"retail_returns_management"}],"references":[{"url":"http://www.securityfocus.com/bid/104252","tags":["vdb-entry","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/05/msg00016.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://www.debian.org/security/2018/dsa-4215","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://usn.ubuntu.com/3661-1/","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://mail-archives.apache.org/mod_mbox/xmlgraphics-batik-dev/201805.mbox/%3c000701d3f28f%24d01860a0%24704921e0%24%40gmail.com%3e","tags":["mailing-list","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1040995","tags":["vdb-entry","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://lists.apache.org/thread.html/r9e90b4d1cf6ea87a79bb506541140dfbf4801f4463a7cee08126ee44%40%3Ccommits.xmlgraphics.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rc0a31867796043fbe59113fb654fe8b13309fe04f8935acb8d0fab19%40%3Ccommits.xmlgraphics.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","tags":["x_transferred","web"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["x_transferred","advisory","web"]},{"url":"https://xmlgraphics.apache.org/security.html","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202401-11","tags":["vendor-advisory","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-8013","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/r9e90b4d1cf6ea87a79bb506541140dfbf4801f4463a7cee08126ee44@%3Ccommits.xmlgraphics.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rc0a31867796043fbe59113fb654fe8b13309fe04f8935acb8d0fab19@%3Ccommits.xmlgraphics.apache.org%3E","tags":["web"]},{"url":"https://mail-archives.apache.org/mod_mbox/xmlgraphics-batik-dev/201805.mbox/%3c000701d3f28f$d01860a0$704921e0$@gmail.com%3e","tags":["web"]},{"url":"https://github.com/apache/xmlgraphics-batik/commit/f91125b26a6ca2b7a1195f1842360bed03629839","tags":["web"]},{"url":"https://issues.apache.org/jira/browse/BATIK-1222","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-8013","tags":["web","report"]},{"url":"https://usn.ubuntu.com/3661-1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-25gw-4pcc-45cf"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-8013","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3661-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-8013","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-8013","description":"In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.","status":"published","published":"2018-05-24T16:00:00Z","modified":"2024-09-16T23:16:36.073Z","updated_at":"2026-11-02T14:35:04.172099Z"}],"euvd":[{"id":"EUVD-2022-1909","description":"In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.","status":"published","published":"2018-05-24T16:00:00Z","modified":"2024-09-16T23:16:36Z","updated_at":"2026-11-03T00:54:54.692655Z"}],"ghsa":[{"id":"GHSA-25gw-4pcc-45cf","title":"Deserialization of Untrusted Data in Apache Batik","description":"In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.","status":"published","published":"2022-05-13T01:14:24Z","modified":"2024-03-04T23:13:21Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:37:39.730152Z"}],"nvd":[{"id":"CVE-2018-8013","description":"In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.","status":"published","published":"2018-05-24T16:29:00.38Z","modified":"2026-06-17T02:04:05.32Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:04:27.507872Z"}],"osv":[{"id":"CVE-2018-8013","description":"In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.","status":"published","published":"2018-05-24T16:29:00.38Z","modified":"2026-10-24T10:30:27.34671715Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:09.74357Z"},{"id":"DEBIAN-CVE-2018-8013","description":"In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.","status":"published","published":"2018-05-24T16:29:00.38Z","modified":"2026-10-23T18:03:09.544779602Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:31.170944Z"},{"id":"GHSA-25gw-4pcc-45cf","title":"Deserialization of Untrusted Data in Apache Batik","description":"In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.","status":"published","published":"2022-05-13T01:14:24Z","modified":"2024-03-14T05:20:16.739Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"UBUNTU-CVE-2018-8013","description":"In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.","status":"published","published":"2018-05-23T00:00:00Z","modified":"2026-02-04T04:27:49.618573Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:18.772093Z"},{"id":"CLSA-2026-1778633124","title":"TuxCare security update for org.apache.xmlgraphics (10 CVEs)","description":"TuxCare rebuilt 27 org.apache.xmlgraphics packages to address 10 CVEs. Fixed in 1.7-tuxcare.1.","status":"published","published":"2026-08-04T14:52:31Z","modified":"2026-10-15T09:46:30.414053178Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"DLA-1385-1","title":"batik - security update","status":"published","published":"2018-05-25T00:00:00Z","modified":"2026-03-09T01:01:27.175481Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-4215-1","title":"batik - security update","status":"published","published":"2018-06-02T00:00:00Z","modified":"2026-03-09T01:19:26.870554Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"USN-3661-1","title":"batik vulnerability","description":"It was discovered that Batik incorrectly handled certain XML.\nAn attacker could possibly use this to expose sensitive information.\n","status":"published","published":"2018-05-29T12:48:53Z","modified":"2026-04-27T15:20:46.511999Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}