Apache XML Graphics Batik: Denial of Service via SVG Element Reference Resolution

published 2026-11-11 23h ago modified 2026-11-11 15h ago also EUVD-2026-123352

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no EPSS score yet
public exploits: 0; none known

Uncontrolled Recursion vulnerability in Apache XML Graphics Batik.

This issue affects Apache XML Graphics Batik: through 1.19.

Users are recommended to upgrade to version 1.20, which fixes the issue.

Is CVE-2026-111792 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
maven	org.apache.xmlgraphics:batik-bridge	<=1.19.0	no fix listed

Affected products

Apache Software Foundation Apache XML Graphics Batik

Classification

Weakness

CWE-674 Uncontrolled Recursion

References

lists.apache.org /thread.html/dn70ltz1o9sg88dd87wcyh4v73fk2tnm
vendor-advisory
issues.apache.org /jira/browse/BATIK-1397
issue-tracking
openwall.com /lists/oss-security/2026/11/11/14

Sources

CVE List CVE-2026-111792
NVD CVE-2026-111792

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.