{"id":"CVE-2022-44729","aliases":["CLSA-2026-1778633124","CLSA-2026-1780966324","CLSA-2026-1789363119","DEBIAN-CVE-2022-44729","DLA-3619-1","EUVD-2023-2297","GHSA-gq5f-xv48-2365","OESA-2023-1651","SUSE-SU-2024:0777-1","SUSE-SU-2024:0808-1","UBUNTU-CVE-2022-44729","openSUSE-SU-2024:13743-1"],"status":"published","title":"Apache XML Graphics Batik: Information disclosure vulnerability","description":"Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.\n\nOn version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00919,"percentile":0.60503,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-918"],"published":"2023-08-22T14:12:50Z","modified":"2026-11-03T08:02:28Z","fixes":[{"ecosystem":"Maven","package":"org.apache.xmlgraphics:batik-bridge","fixed_in":["1.17"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.xmlgraphics:batik-svgrasterizer","fixed_in":["1.17"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.xmlgraphics:batik-transcoder","fixed_in":["1.17"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-bridge","fixed_in":["1.8-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-transcoder","fixed_in":["1.8-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"batik","fixed_in":["1.16+dfsg-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"batik","fixed_in":["1.17+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"batik","fixed_in":["1.17+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.xmlgraphics:batik-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0"},{"fixed":"1.17"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.xmlgraphics:batik-svgrasterizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0"},{"fixed":"1.17"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.xmlgraphics:batik-transcoder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0"},{"fixed":"1.17"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-anim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-awt-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-css","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-dom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-ext","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-extension","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-extensions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-gui-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-gvt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-rasterizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-rasterizer-ext","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-script","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-slideshow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-squiggle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-squiggle-ext","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-svg-dom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-svggen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-svgpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-swing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-transcoder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-ttf2svg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8"},{"fixed":"1.8-tuxcare.1"}]}],"versions":["1.8"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-transcoder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8"},{"fixed":"1.8-tuxcare.1"}]}],"versions":["1.8"]},{"source":"osv","ecosystem":"Debian:12","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16+dfsg-1+deb12u1"}]}],"versions":["1.16+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-2+deb10u3"}]}],"versions":["1.10-2","1.10-2+deb10u1","1.10-2+deb10u2"],"bundled":6},{"source":"osv","ecosystem":"Maven","package":"org.apache.xmlgraphics:batik-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0"},{"fixed":"1.17"}]}],"versions":["1.10","1.11","1.12","1.13","1.14","1.15","1.16","1.6.1","1.7","1.8","1.9","1.9.1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.xmlgraphics:batik-svgrasterizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0"},{"fixed":"1.17"}]}],"versions":["1.10","1.11","1.12","1.13","1.14","1.15","1.16","1.9","1.9.1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.xmlgraphics:batik-transcoder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0"},{"fixed":"1.17"}]}],"versions":["1.10","1.11","1.12","1.13","1.14","1.15","1.16","1.6.1","1.7","1.8","1.9","1.9.1"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-1.oe1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-1.oe1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-1.oe2203sp2"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-1.oe2203sp1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-1.oe2203sp2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"xmlgraphics-batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-2.7.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"xmlgraphics-batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-150200.4.7.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"xmlgraphics-batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-150200.4.7.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.ubuntu-8ubuntu3","1.8-3","1.8-3ubuntu1","1.8-3ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9-3","1.10-2~18.04","1.10-2~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10-2","1.12-1","1.12-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.12-4","1.14-1","1.14-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16+dfsg-1","1.17+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18+dfsg-2build1","1.19-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18+dfsg-2","1.18+dfsg-2build1"]}],"products":[{"vendor":"apache","product":"xml_graphics_batik"},{"vendor":"apache software foundation","product":"apache xml graphics batik"},{"vendor":"debian","product":"debian_linux"}],"references":[{"url":"https://xmlgraphics.apache.org/security.html","tags":["x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://lists.apache.org/thread/hco2nw1typoorz33qzs0fcdx0ws6d6j2","tags":["vendor-advisory","x_transferred","Mailing List","Vendor Advisory","advisory","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2023/08/22/2","tags":["x_transferred","Mailing List","Third Party Advisory","advisory","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2023/08/22/4","tags":["x_transferred","Mailing List","Third Party Advisory","advisory","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00021.html","tags":["x_transferred","Mailing List","article","web"]},{"url":"https://security.gentoo.org/glsa/202401-11","tags":["x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-44729","tags":["advisory"]},{"url":"https://github.com/apache/xmlgraphics-batik/commit/85b3457d9902f64d5d409a8da060d5ba47d0b69b","tags":["web"]},{"url":"https://github.com/apache/xmlgraphics-batik/commit/aaa1dd3e6b5a7df781d73e0c37a1df6a8f318893","tags":["web"]},{"url":"https://issues.apache.org/jira/browse/BATIK-1349","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-gq5f-xv48-2365"},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-44729","tags":["advisory"]},{"url":"https://github.com/apache/xmlgraphics-batik","tags":["package"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1651","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38398","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38648","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40146","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-44730","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240777-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1034675","tags":["report"]},{"url":"https://bugzilla.suse.com/1172961","tags":["report"]},{"url":"https://bugzilla.suse.com/1182748","tags":["report"]},{"url":"https://bugzilla.suse.com/1203672","tags":["report"]},{"url":"https://bugzilla.suse.com/1203673","tags":["report"]},{"url":"https://bugzilla.suse.com/1203674","tags":["report"]},{"url":"https://bugzilla.suse.com/1204704","tags":["report"]},{"url":"https://bugzilla.suse.com/1204709","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-38398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-38648","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-40146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-42890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44730","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240808-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-44729","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2023/08/22/2","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-44729","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-44729","title":"Apache XML Graphics Batik: Information disclosure vulnerability","description":"Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.\n\nOn version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.","status":"published","published":"2023-08-22T14:12:50.301Z","modified":"2026-10-08T21:24:17.324Z","cwes":["CWE-918"],"updated_at":"2026-11-02T14:34:30.176321Z"}],"euvd":[{"id":"EUVD-2023-2297","description":"Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.\n\nOn version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.","status":"published","published":"2023-08-22T14:12:50Z","modified":"2026-10-08T21:24:17Z","updated_at":"2026-11-02T17:27:25.942984Z"}],"ghsa":[{"id":"GHSA-gq5f-xv48-2365","title":"Apache XML Graphics Batik Server-Side Request Forgery vulnerability","description":"Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.\n\nOn version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.","status":"published","published":"2023-08-22T21:30:26Z","modified":"2025-02-13T19:10:33Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:38:31.416868Z"}],"nvd":[{"id":"CVE-2022-44729","description":"Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.\n\nOn version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.","status":"published","published":"2023-08-22T19:16:29.833Z","modified":"2026-10-08T22:17:22.09Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:07:39.811118Z"}],"osv":[{"id":"CVE-2022-44729","description":"Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.\n\nOn version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.","status":"published","published":"2023-08-22T19:16:29.833Z","modified":"2026-03-15T22:45:36.710109Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:27.481647Z"},{"id":"DEBIAN-CVE-2022-44729","description":"Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.  On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.","status":"published","published":"2023-08-22T19:16:29.833Z","modified":"2026-11-03T08:02:28.436187266Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T08:24:50.542442Z"},{"id":"GHSA-gq5f-xv48-2365","title":"Apache XML Graphics Batik Server-Side Request Forgery vulnerability","description":"Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.\n\nOn version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.","status":"published","published":"2023-08-22T21:30:26Z","modified":"2025-02-13T19:36:34.414973Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:46:48.191583Z"},{"id":"OESA-2023-1651","title":"batik security update","description":"Batik is an inline templating engine for CoffeeScript, inspired by CoffeeKup,  that lets you write your template directly as a CoffeeScript function.\r\n\r\nSecurity Fix(es):\r\n\r\nServer-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. This issue affects Apache XML Graphics Batik 1.14.(CVE-2022-38398)\r\n\r\nServer-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.(CVE-2022-38648)\r\n\r\nServer-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14.(CVE-2022-40146)\r\n\r\nServer-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.\r\n\r\nOn version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.\r\n\r\n(CVE-2022-44729)\r\n\r\nServer-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.\r\n\r\nA malicious SVG can probe user profile / data and send it directly as parameter to a URL.\r\n\r\n(CVE-2022-44730)","status":"published","published":"2023-09-15T11:06:06Z","modified":"2026-08-18T01:16:36.941225638Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"UBUNTU-CVE-2022-44729","description":"Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.","status":"published","published":"2023-08-22T19:16:00Z","modified":"2026-10-17T12:56:22.867872307Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:56.473586Z"},{"id":"CLSA-2026-1778633124","title":"TuxCare security update for org.apache.xmlgraphics (10 CVEs)","description":"TuxCare rebuilt 27 org.apache.xmlgraphics packages to address 10 CVEs. Fixed in 1.7-tuxcare.1.","status":"published","published":"2026-08-04T14:52:31Z","modified":"2026-10-15T09:46:30.414053178Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1780966324","title":"TuxCare security update for org.apache.xmlgraphics (1 CVE)","description":"TuxCare rebuilt 2 org.apache.xmlgraphics packages to address 1 CVE. Fixed in 1.8-tuxcare.1.","status":"published","published":"2026-08-04T14:52:35Z","modified":"2026-11-02T19:45:34.363279655Z","updated_at":"2026-11-02T20:30:13.950198Z"},{"id":"CLSA-2026-1789363119","title":"TuxCare security update for commons-configuration:commons-configuration (1 CVE)","description":"TuxCare rebuilt commons-configuration:commons-configuration to address 1 CVE. Fixed in 1.8-tuxcare.1.","status":"withdrawn","published":"2026-09-14T05:18:39Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"DLA-3619-1","title":"batik - security update","status":"published","published":"2023-10-14T00:00:00Z","modified":"2026-03-09T01:23:12.351122Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"openSUSE-SU-2024:13743-1","title":"xmlgraphics-batik-1.17-1.1 on GA media","description":"These are all security issues fixed in the xmlgraphics-batik-1.17-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:21:38.395955Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2024:0777-1","title":"Security update for xmlgraphics-batik","description":"This update for xmlgraphics-batik fixes the following issues:\n\n- CVE-2017-5662: Fixed Apache Batik information disclosure vulnerability (bsc#1034675).\n- CVE-2019-17566: Fixed SSRF vulnerability (bsc#1172961).\n- CVE-2020-11987: Fixed Apache XML Graphics Batik SSRF vulnerability (bsc#1182748).\n- CVE-2022-38398: Fixed information disclosure vulnerability (bsc#1203674).\n- CVE-2022-38648: Fixed information disclosure vulnerability (bsc#1203673).\n- CVE-2022-40146: Fixed information disclosure vulnerability (bsc#1203672).\n- CVE-2022-41704: Fixed information disclosure vulnerability in Apache Batik (bsc#1204704).\n- CVE-2022-42890: Fixed information disclosure vulnerability in Apache Batik (bsc#1204709).\n- CVE-2022-44729: Fixed Server-Side Request Forgery.\n- CVE-2022-44730: Fixed Server-Side Request Forgery.\n\nUpgrade to version 1.17.\n","status":"published","published":"2024-03-06T11:54:24Z","modified":"2026-02-04T03:34:59.610627Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0808-1","title":"Security update for xmlgraphics-batik","description":"This update for xmlgraphics-batik fixes the following issues:\n\n- CVE-2022-41704: Fixed information disclosure vulnerability in Apache Batik (bsc#1204704).\n- CVE-2022-42890: Fixed information disclosure vulnerability in Apache Batik (bsc#1204709).\n- CVE-2022-44730: Fixed Server-Side Request Forgery.\n- CVE-2022-44729: Fixed Server-Side Request Forgery.\n\nUpgrade to version 1.17.\n","status":"published","published":"2024-03-07T19:46:57Z","modified":"2026-02-04T03:56:32.934201Z","updated_at":"2026-11-02T15:53:54.239786Z"}]}}