DEBIAN-CVE-2026-89326: Debian/batik vulnerability

Q: Which Batik versions are affected and what version fixes the issue?

Apache XML Graphics Batik through version 1.19 is affected. Upgrade to version 1.20, which fixes the external resource same-origin protocol comparison issue.

Published Nov 11, 2026

Updated

Origin Validation Error vulnerability in Apache XML Graphics Batik: the external resource same-origin check does not compare the URL protocol This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.

Affected Software

3 affected componentsFixes available

debian/batik*

debian/batik<1.20-1

1.20-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/batik to a version that resolves this vulnerability.
Fixed in 1.20-1
Upgrade
Upgrade Apache XML Graphics Batik to a version that resolves this vulnerability.
Fixed in 1.20

Event History

Nov 11, 2026

CVE Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionAffected Software

Frequently Asked Questions

Which Batik versions are affected and what version fixes the issue?

Apache XML Graphics Batik through version 1.19 is affected. Upgrade to version 1.20, which fixes the external resource same-origin protocol comparison issue.