CVE-2026-44929 · Package
NO FIX YET · SEE WHAT TO DO
Apache XML Graphics Batik through version 1.19 has a Server-Side Request Forgery flaw. An attacker who can supply content Batik processes can make the server send requests to addresses of the attacker's choosing, including internal ones.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that use Apache Batik to parse or render SVG or XML that can come from untrusted users are the ones exposed. Systems that only process trusted, internally generated documents are unlikely to be reachable by the attack. unknown whether specific configurations change exposure.
Not affected if trusted-input-only
Who cares batik, java, svg
batik-all or batik-* artifacts in your build file, and confirm whether it is 1.19 or earlier.1.20Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik.
This issue affects Apache XML Graphics Batik: through 1.19.
Users are recommended to upgrade to version 1.20, which fixes the issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.