CVE-2026-111792 · Package
NO FIX YET · SEE WHAT TO DO
Apache XML Graphics Batik, a Java library for rendering SVG, contains an uncontrolled recursion flaw in versions through 1.19. The sources do not state what an attacker gets beyond the recursion itself.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that include Apache Batik through version 1.19 and parse untrusted SVG or XML input are the ones to look at. The sources do not say which code paths trigger the recursion, so exposure beyond that is unknown.
Not affected if batik-1.20-or-later, batik-not-used
Who cares batik, java, svg
batik JARs in your Java dependencies and note the version, e.g. batik-svggen or batik-transcoder at 1.19 or lower.pom.xml or build.gradle) for the Batik version pinned.1.20.Uncontrolled Recursion vulnerability in Apache XML Graphics Batik.
This issue affects Apache XML Graphics Batik: through 1.19.
Users are recommended to upgrade to version 1.20, which fixes the issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.