CVE-2026-71395: Apache XML Graphics FOP: CWE-502 unsafe deserialization in hyphenation loading
Published Nov 11, 2026
·Updated
unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOP.
This issue affects Apache XML Graphics FOP: through 2.11.
Users are recommended to upgrade to version 2.12, which fixes the issue.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache XML Graphics FOPto a version that resolves this vulnerability.Fixed in 2.12
Event History
Nov 11, 2026
CVE Published
via MITRE·02:53 PM
Data Sourced
via MITRE·02:53 PM
DescriptionWeakness
Data Sourced
via NVD·03:17 PM
DescriptionWeakness
Frequently Asked Questions
1
Which FOP versions need to be remediated?
Apache XML Graphics FOP versions through 2.11 are affected. Upgrade to version 2.12, which fixes the issue.
2
Which part of FOP is implicated?
The vulnerability is in hyphenation loading and involves unsafe deserialization.