{"id":"CVE-2026-111792","kind":"vulnerability","aliases":["CVE-2026-111792"],"related":[],"title":"Apache Batik: uncontrolled recursion flaw in XML graphics handling","description":"Uncontrolled Recursion vulnerability in Apache XML Graphics Batik.\n\n\n\nThis issue affects Apache XML Graphics Batik: through 1.19.\n\n\n\nUsers are recommended to upgrade to version 1.20, which fixes the issue.","summary":"Apache XML Graphics Batik, a Java library for rendering SVG, contains an uncontrolled recursion flaw in versions through 1.19. The sources do not state what an attacker gets beyond the recursion itself.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["batik","java","package","svg"],"not_affected_if":["batik-1.20-or-later","batik-not-used"],"how_to_check":"- Look for `batik` JARs in your Java dependencies and note the version, e.g. `batik-svggen` or `batik-transcoder` at `1.19` or lower.\n- Check your build file (`pom.xml` or `build.gradle`) for the Batik version pinned.","fix":"- Upgrade Apache XML Graphics Batik to `1.20`.","status":"open","published_at":"2026-11-11T11:17:11+00:00","first_seen_at":"2026-11-11T11:26:55+00:00","triaged_at":"2026-11-11T11:27:36+00:00","updated_at":"2026-11-11T11:27:36+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-11T11:27:36Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache XML Graphics Batik to `1.20`.","reach":"unknown","title":"Apache Batik: uncontrolled recursion flaw in XML graphics handling","impact":"medium","summary":"Apache XML Graphics Batik, a Java library for rendering SVG, contains an uncontrolled recursion flaw in versions through 1.19. The sources do not state what an attacker gets beyond the recursion itself.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","batik","svg"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown; sources only describe uncontrolled recursion","analyst_note":"Check the Apache Batik security advisory for the trigger, the worst-case impact and whether it is a denial of service, and confirm the 1.20 fixed version.","how_to_check":"- Look for `batik` JARs in your Java dependencies and note the version, e.g. `batik-svggen` or `batik-transcoder` at `1.19` or lower.\n- Check your build file (`pom.xml` or `build.gradle`) for the Batik version pinned.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["batik-not-used","batik-1.20-or-later"],"who_is_affected":"Applications that include Apache Batik through version 1.19 and parse untrusted SVG or XML input are the ones to look at. The sources do not say which code paths trigger the recursion, so exposure beyond that is unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000744,"input_tokens":4519,"output_tokens":584,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111792':12A,15A '-2026':11A,14A '1.19':38B,67C '1.20':75C 'affect':61C 'apach':1A,20B,55C,62C 'attack':46B 'batik':2A,16B,23B,58C,65C 'beyond':48B 'contain':30B 'cve':10A,13A 'fix':77C 'flaw':5A,34B 'get':47B 'graphic':8A,22B,57C,64C 'handl':9A 'issu':60C,79C 'java':17B,25B 'librari':26B 'packag':18B 'recommend':70C 'recurs':4A,33B,50B,52C 'render':28B 'sourc':40B 'state':43B 'svg':19B,29B 'uncontrol':3A,32B,51C 'upgrad':72C 'user':68C 'version':36B,74C 'vulner':53C 'xml':7A,21B,56C,63C","nicknames":[],"mitigations":[],"who_affected":"Applications that include Apache Batik through version 1.19 and parse untrusted SVG or XML input are the ones to look at. The sources do not say which code paths trigger the recursion, so exposure beyond that is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["batik","java","package","svg","unknown"],"campaign_type":null,"search_a":"'-111792':12A,15A '-2026':11A,14A 'apach':1A 'batik':2A 'cve':10A,13A 'flaw':5A 'graphic':8A 'handl':9A 'recurs':4A 'uncontrol':3A 'xml':7A","search_b":"'1.19':38B 'apach':20B 'attack':46B 'batik':16B,23B 'beyond':48B 'contain':30B 'flaw':34B 'get':47B 'graphic':22B 'java':17B,25B 'librari':26B 'packag':18B 'recurs':33B,50B 'render':28B 'sourc':40B 'state':43B 'svg':19B,29B 'uncontrol':32B 'version':36B 'xml':21B","search_c":"'1.19':67C '1.20':75C 'affect':61C 'apach':55C,62C 'batik':58C,65C 'fix':77C 'graphic':57C,64C 'issu':60C,79C 'recommend':70C 'recurs':52C 'uncontrol':51C 'upgrad':72C 'user':68C 'version':74C 'vulner':53C 'xml':56C,63C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T11:17:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111792","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111792","severity":null,"published_at":"2026-11-11T11:17:11+00:00","modified_at":"2026-11-11T11:17:11+00:00","first_seen_at":"2026-11-11T11:26:55+00:00","fetched_at":"2026-11-11T11:26:55+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}