{"id":"CVE-2026-71395","aliases":["DEBIAN-CVE-2026-71395","EUVD-2026-123531","GHSA-538h-76qv-3vqw","UBUNTU-CVE-2026-71395"],"status":"published","title":"Apache XML Graphics FOP: CWE-502 unsafe deserialization in hyphenation loading","description":"unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOP.\n\n\n\nThis issue affects Apache XML Graphics FOP: through 2.11.\n\n\n\nUsers are recommended to upgrade to version 2.12, which fixes the issue.","epss":{"day":"2026-11-12","score":0.00358,"percentile":0.30024,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-502"],"published":"2026-11-11T14:53:54Z","modified":"2026-11-12T23:48:19Z","affected":[{"source":"osv","ecosystem":"Debian:12","package":"fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.10+dfsg-1","1:2.10+dfsg-1~exp0","1:2.10+dfsg-1~exp1","1:2.10+dfsg-2","1:2.10+dfsg1-1","1:2.10+dfsg1-2","1:2.10+dfsg1-3","1:2.10+dfsg1-4","1:2.8-2","1:2.8-3"]},{"source":"osv","ecosystem":"Debian:13","package":"fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.10+dfsg-2","1:2.10+dfsg1-1","1:2.10+dfsg1-2","1:2.10+dfsg1-3","1:2.10+dfsg1-4"]},{"source":"osv","ecosystem":"Debian:14","package":"fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.10+dfsg-2","1:2.10+dfsg1-1","1:2.10+dfsg1-2","1:2.10+dfsg1-3","1:2.10+dfsg1-4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.1.dfsg2-1ubuntu1","1:2.1-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.1-7"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.3-2","1:2.4-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.5-3","1:2.6-1","1:2.6-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.8-2","1:2.8-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.10+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.10+dfsg-2"]}],"products":[{"vendor":"apache software foundation","product":"apache xml graphics fop"}],"references":[{"url":"https://issues.apache.org/jira/browse/FOP-3332","tags":["issue-tracking","report"]},{"url":"https://lists.apache.org/thread.html/nsb89to1r0vzdh3t4w7x10q4z3xk5jqf","tags":["vendor-advisory","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/11/11/19","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71395"},{"url":"https://github.com/advisories/GHSA-538h-76qv-3vqw"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-71395","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-71395","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71395","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-71395","title":"Apache XML Graphics FOP: CWE-502 unsafe deserialization in hyphenation loading","description":"unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOP.\n\n\n\nThis issue affects Apache XML Graphics FOP: through 2.11.\n\n\n\nUsers are recommended to upgrade to version 2.12, which fixes the issue.","status":"published","published":"2026-11-11T14:53:54.218Z","modified":"2026-11-11T19:05:32.557Z","cwes":["CWE-502"],"updated_at":"2026-11-11T21:33:02.961334Z"}],"euvd":[{"id":"EUVD-2026-123531","description":"unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOP.\n\n\n\nThis issue affects Apache XML Graphics FOP: through 2.11.\n\n\n\nUsers are recommended to upgrade to version 2.12, which fixes the issue.","status":"published","published":"2026-11-11T14:53:54Z","modified":"2026-11-11T19:05:32Z","updated_at":"2026-11-11T17:29:39.353655Z"}],"ghsa":[{"id":"GHSA-538h-76qv-3vqw","title":"unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOP.\n\n\n\nThis...","description":"unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOP.\n\n\n\nThis issue affects Apache XML Graphics FOP: through 2.11.\n\n\n\nUsers are recommended to upgrade to version 2.12, which fixes the issue.","status":"published","published":"2026-11-11T15:31:05Z","modified":"2026-11-11T21:34:00Z","cwes":["CWE-502"],"updated_at":"2026-11-11T21:36:29.153415Z"}],"nvd":[{"id":"CVE-2026-71395","description":"unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOP.\n\n\n\nThis issue affects Apache XML Graphics FOP: through 2.11.\n\n\n\nUsers are recommended to upgrade to version 2.12, which fixes the issue.","status":"published","published":"2026-11-11T15:17:24.763Z","modified":"2026-11-12T17:01:06.913Z","cwes":["CWE-502"],"updated_at":"2026-11-11T21:26:20.111639Z"}],"osv":[{"id":"DEBIAN-CVE-2026-71395","description":"unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOP.    This issue affects Apache XML Graphics FOP: through 2.11.    Users are recommended to upgrade to version 2.12, which fixes the issue.","status":"published","published":"2026-11-11T15:17:24.763Z","modified":"2026-11-12T10:02:00.343635127Z","updated_at":"2026-11-12T10:15:48.743889Z"},{"id":"UBUNTU-CVE-2026-71395","description":"unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: through 2.11. Users are recommended to upgrade to version 2.12, which fixes the issue.","status":"published","published":"2026-11-12T00:00:00Z","modified":"2026-11-12T23:48:19.745562101Z","updated_at":"2026-11-13T00:20:49.964796Z"}]}}