CVE-2026-71395

Apache XML Graphics FOP: CWE-502 unsafe deserialization in hyphenation loading

Unrated

Apache FOP Core

Published Nov 11, 2026, 14:53 UTC

Description

unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: through 2.11. Users are recommended to upgrade to version 2.12, which fixes the issue.

Official CVE record Read Eden case study View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.