{"id":"CVE-2026-44929","kind":"vulnerability","aliases":["CVE-2026-44929"],"related":[],"title":"Apache Batik: SSRF flaw lets attackers make the server fetch URLs","description":"Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik.\n\n\n\nThis issue affects Apache XML Graphics Batik: through 1.19.\n\n\n\nUsers are recommended to upgrade to version 1.20, which fixes the issue.","summary":"Apache XML Graphics Batik through version 1.19 has a Server-Side Request Forgery flaw. An attacker who can supply content Batik processes can make the server send requests to addresses of the attacker's choosing, including internal ones.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["batik","java","package","svg"],"not_affected_if":["trusted-input-only"],"how_to_check":"- Check the Batik version in your dependencies, for example `batik-all` or `batik-*` artifacts in your build file, and confirm whether it is `1.19` or earlier.\n- Find code paths that pass untrusted SVG or XML documents to Batik for rendering or transcoding.","fix":"- Apache XML Graphics Batik: upgrade to `1.20`","status":"open","published_at":"2026-11-11T15:17:23+00:00","first_seen_at":"2026-11-11T15:27:50+00:00","triaged_at":"2026-11-11T15:29:53+00:00","updated_at":"2026-11-11T15:29:53+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T15:29:53Z","model":"claude-haiku-5-5","output":{"fix":"- Apache XML Graphics Batik: upgrade to `1.20`","reach":"network","title":"Apache Batik: SSRF flaw lets attackers make the server fetch URLs","impact":"medium","summary":"Apache XML Graphics Batik through version 1.19 has a Server-Side Request Forgery flaw. An attacker who can supply content Batik processes can make the server send requests to addresses of the attacker's choosing, including internal ones.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","batik","svg"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"server makes requests to internal addresses on attacker's behalf","analyst_note":"","how_to_check":"- Check the Batik version in your dependencies, for example `batik-all` or `batik-*` artifacts in your build file, and confirm whether it is `1.19` or earlier.\n- Find code paths that pass untrusted SVG or XML documents to Batik for rendering or transcoding.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["trusted-input-only"],"who_is_affected":"Applications that use Apache Batik to parse or render SVG or XML that can come from untrusted users are the ones exposed. Systems that only process trusted, internally generated documents are unlikely to be reachable by the attack. unknown whether specific configurations change exposure.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000717,"input_tokens":4531,"output_tokens":528,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-44929':14A,17A '1.19':28B,81C '1.20':89C 'address':52B 'affect':75C 'apach':1A,22B,69C,76C 'attack':6A,38B,55B 'batik':2A,18B,25B,43B,72C,79C 'choos':57B 'content':42B 'cve':12A,15A 'fetch':10A 'fix':91C 'flaw':4A,36B 'forgeri':35B,65C 'graphic':24B,71C,78C 'includ':58B 'intern':59B 'issu':74C,93C 'java':19B 'let':5A 'make':7A,46B 'one':60B 'packag':20B 'process':44B 'recommend':84C 'request':34B,50B,64C 'send':49B 'server':9A,32B,48B,62C 'server-sid':31B,61C 'side':33B,63C 'ssrf':3A,66C 'suppli':41B 'svg':21B 'upgrad':86C 'url':11A 'user':82C 'version':27B,88C 'vulner':67C 'xml':23B,70C,77C","nicknames":[],"mitigations":[],"who_affected":"Applications that use Apache Batik to parse or render SVG or XML that can come from untrusted users are the ones exposed. Systems that only process trusted, internally generated documents are unlikely to be reachable by the attack. unknown whether specific configurations change exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["batik","java","package","svg","unknown"],"campaign_type":null,"search_a":"'-2026':13A,16A '-44929':14A,17A 'apach':1A 'attack':6A 'batik':2A 'cve':12A,15A 'fetch':10A 'flaw':4A 'let':5A 'make':7A 'server':9A 'ssrf':3A 'url':11A","search_b":"'1.19':28B 'address':52B 'apach':22B 'attack':38B,55B 'batik':18B,25B,43B 'choos':57B 'content':42B 'flaw':36B 'forgeri':35B 'graphic':24B 'includ':58B 'intern':59B 'java':19B 'make':46B 'one':60B 'packag':20B 'process':44B 'request':34B,50B 'send':49B 'server':32B,48B 'server-sid':31B 'side':33B 'suppli':41B 'svg':21B 'version':27B 'xml':23B","search_c":"'1.19':81C '1.20':89C 'affect':75C 'apach':69C,76C 'batik':72C,79C 'fix':91C 'forgeri':65C 'graphic':71C,78C 'issu':74C,93C 'recommend':84C 'request':64C 'server':62C 'server-sid':61C 'side':63C 'ssrf':66C 'upgrad':86C 'user':82C 'version':88C 'vulner':67C 'xml':70C,77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T15:17:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-44929","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44929","severity":null,"published_at":"2026-11-11T15:17:23+00:00","modified_at":"2026-11-11T15:17:23+00:00","first_seen_at":"2026-11-11T15:27:50+00:00","fetched_at":"2026-11-11T15:27:50+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}