{"id":"CVE-2026-71395","aliases":[],"cve":{"records":[{"id":"CVE-2026-71395","source":"apache","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-08-06T09:27:16.734Z","published":"2026-11-11T14:53:54.218Z","modified":"2026-11-11T19:05:32.557Z"}],"publishers":[{"name":"apache","role":"CNA","organizationId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","modified":"2026-11-11T14:53:54.218Z"},{"name":"CVE","role":"ADP","organizationId":"af854a3a-2127-422b-91ae-364da2661108","modified":"2026-11-11T19:05:32.557Z"}],"references":[{"url":"https://issues.apache.org/jira/browse/FOP-3332","tags":["issue-tracking"],"source":"apache"},{"url":"https://lists.apache.org/thread.html/nsb89to1r0vzdh3t4w7x10q4z3xk5jqf","tags":["vendor-advisory"],"source":"apache"},{"url":"http://www.openwall.com/lists/oss-security/2026/11/11/19","tags":[],"source":"CVE"}],"weaknesses":[{"id":"CWE-502","description":"CWE-502 unsafe deserialization in hyphenation loading","source":"apache"}],"applicability":[],"prioritization":[]},"title":"Apache XML Graphics FOP: CWE-502 unsafe deserialization in hyphenation loading","titleSource":"apache","descriptionSource":"apache","description":"unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOP.\n\n\n\nThis issue affects Apache XML Graphics FOP: through 2.11.\n\n\n\nUsers are recommended to upgrade to version 2.12, which fixes the issue.","score":null,"severity":"unknown","published":"2026-11-11T14:53:54.218Z","modified":"2026-11-11T19:05:32.557Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Apache Software Foundation","name":"Apache XML Graphics FOP","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.11.0","versionType":"maven"}],"defaultStatus":"unaffected","packageURL":"pkg:maven/org.apache.xmlgraphics/fop-core","packageIdentity":{"ecosystem":"Maven","name":"org.apache.xmlgraphics:fop-core"},"cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-71395"}],"remediation":[],"references":["https://issues.apache.org/jira/browse/FOP-3332","https://lists.apache.org/thread.html/nsb89to1r0vzdh3t4w7x10q4z3xk5jqf","http://www.openwall.com/lists/oss-security/2026/11/11/19"],"sources":[{"name":"CVE","id":"CVE-2026-71395","modified":"2026-11-11T19:05:32.557Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-71395"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-11-11T20:38:31.346Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:00:33.565Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-11T16:16:23.498Z","attemptedAt":"2026-11-11T16:16:23.498Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-11T16:16:22.628Z","attemptedAt":"2026-11-11T16:16:22.628Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-11T16:16:24.096Z","attemptedAt":"2026-11-11T16:16:24.096Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-11T16:16:19.678Z","attemptedAt":"2026-11-11T16:16:19.678Z"}],"evidence":[{"source":"GitHub Advisory Database","id":"GHSA-538h-76qv-3vqw","url":"https://github.com/advisories/GHSA-538h-76qv-3vqw","modified":"2026-11-11T15:31:06Z","checkedAt":"2026-11-11T16:16:22.628Z"},{"source":"NVD","id":"CVE-2026-71395","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71395","modified":"2026-11-11T15:17:24.763","checkedAt":"2026-11-11T16:16:23.498Z"},{"source":"ENISA EUVD","id":"EUVD-2026-123531","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-123531","modified":"Nov 11, 2026, 3:31:05 PM","checkedAt":"2026-11-11T16:16:24.096Z"}],"aiSummary":{"text":"Apache XML Graphics FOP through version 2.11 has an unsafe deserialization vulnerability in hyphenation loading, which may be exploited by an attacker with access to the system. The impact of this weakness is not specified. Version 2.12 is reported to fix the issue.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-11T15:36:14.054Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-71395"}]}}