{"id":"CVE-2026-71395","kind":"vulnerability","aliases":["CVE-2026-71395"],"related":[],"title":"Apache FOP: unsafe deserialization when loading hyphenation files","description":"unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOP.\n\n\n\nThis issue affects Apache XML Graphics FOP: through 2.11.\n\n\n\nUsers are recommended to upgrade to version 2.12, which fixes the issue.","summary":"Apache XML Graphics FOP, a Java tool that turns XSL-FO documents into PDF, deserializes data unsafely while loading hyphenation patterns. The sources do not say what an attacker can run or read as a result.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-fop","java","package","pdf-rendering","xsl-fo"],"not_affected_if":["fop-not-used"],"how_to_check":"- Look for the `fop` jar or the `org.apache.xmlgraphics:fop` dependency in your build files and note its version\n- Check the FOP version your service runs, for example in the Maven or Gradle lock file\n- Check whether your application loads custom hyphenation files","fix":"- Upgrade Apache XML Graphics FOP to `2.12`, which the sources say fixes the issue","status":"open","published_at":"2026-11-11T15:17:24+00:00","first_seen_at":"2026-11-11T15:27:50+00:00","triaged_at":"2026-11-11T15:29:54+00:00","updated_at":"2026-11-11T15:29:54+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-11T15:29:54Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache XML Graphics FOP to `2.12`, which the sources say fixes the issue","reach":"unknown","title":"Apache FOP: unsafe deserialization when loading hyphenation files","impact":"high","summary":"Apache XML Graphics FOP, a Java tool that turns XSL-FO documents into PDF, deserializes data unsafely while loading hyphenation patterns. The sources do not say what an attacker can run or read as a result.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","apache-fop","xsl-fo","pdf-rendering"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown; the sources do not say what an attacker gains","analyst_note":"Check the Apache FOP security advisory for CVE-2026-71395 to learn the trigger input, required configuration and attacker impact.","how_to_check":"- Look for the `fop` jar or the `org.apache.xmlgraphics:fop` dependency in your build files and note its version\n- Check the FOP version your service runs, for example in the Maven or Gradle lock file\n- Check whether your application loads custom hyphenation files","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["fop-not-used"],"who_is_affected":"Applications that embed Apache FOP through version 2.11 and load hyphenation patterns, typically when rendering XSL-FO to PDF on a server. The sources do not say whether default configurations or untrusted input are needed to trigger it. Teams that do not use FOP can skip it.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000757,"input_tokens":4529,"output_tokens":608,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':10A,13A '-71395':11A,14A '2.11':82C '2.12':90C 'affect':76C 'apach':1A,16B,26B,70C,77C 'apache-fop':15B 'attack':55B 'cve':9A,12A 'data':42B 'deseri':4A,41B,64C 'document':38B 'file':8A 'fix':92C 'fo':25B,37B 'fop':2A,17B,29B,73C,80C 'graphic':28B,72C,79C 'hyphen':7A,46B,66C 'issu':75C,94C 'java':18B,31B 'load':6A,45B,67C 'packag':19B 'pattern':47B 'pdf':21B,40B 'pdf-render':20B 'read':59B 'recommend':85C 'render':22B 'result':62B 'run':57B 'say':52B 'sourc':49B 'tool':32B 'turn':34B 'unsaf':3A,43B,63C 'upgrad':87C 'user':83C 'version':89C 'vulner':68C 'xml':27B,71C,78C 'xsl':24B,36B 'xsl-fo':23B,35B","nicknames":[],"mitigations":[],"who_affected":"Applications that embed Apache FOP through version 2.11 and load hyphenation patterns, typically when rendering XSL-FO to PDF on a server. The sources do not say whether default configurations or untrusted input are needed to trigger it. Teams that do not use FOP can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apachefop","java","package","pdfrendering","unknown","xslfo"],"campaign_type":null,"search_a":"'-2026':10A,13A '-71395':11A,14A 'apach':1A 'cve':9A,12A 'deseri':4A 'file':8A 'fop':2A 'hyphen':7A 'load':6A 'unsaf':3A","search_b":"'apach':16B,26B 'apache-fop':15B 'attack':55B 'data':42B 'deseri':41B 'document':38B 'fo':25B,37B 'fop':17B,29B 'graphic':28B 'hyphen':46B 'java':18B,31B 'load':45B 'packag':19B 'pattern':47B 'pdf':21B,40B 'pdf-render':20B 'read':59B 'render':22B 'result':62B 'run':57B 'say':52B 'sourc':49B 'tool':32B 'turn':34B 'unsaf':43B 'xml':27B 'xsl':24B,36B 'xsl-fo':23B,35B","search_c":"'2.11':82C '2.12':90C 'affect':76C 'apach':70C,77C 'deseri':64C 'fix':92C 'fop':73C,80C 'graphic':72C,79C 'hyphen':66C 'issu':75C,94C 'load':67C 'recommend':85C 'unsaf':63C 'upgrad':87C 'user':83C 'version':89C 'vulner':68C 'xml':71C,78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T15:17:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-71395","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71395","severity":null,"published_at":"2026-11-11T15:17:24+00:00","modified_at":"2026-11-11T15:17:24+00:00","first_seen_at":"2026-11-11T15:27:50+00:00","fetched_at":"2026-11-11T15:27:50+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}