UBUNTU-CVE-2026-71395: Medium severity ubuntu/fop vulnerability
Published Nov 12, 2026
·Updated
unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: through 2.11. Users are recommended to upgrade to version 2.12, which fixes the issue.
Affected Software
7 affected components
ubuntu/fop*
ubuntu/fop*
ubuntu/fop*
ubuntu/fop*
ubuntu/fop*
ubuntu/fop*
ubuntu/fop*
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache XML Graphics FOPto a version that resolves this vulnerability.Fixed in 2.12
Event History
Nov 12, 2026
CVE Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Which FOP versions are affected, and what version fixes the issue?
Apache XML Graphics FOP versions through 2.11 are affected. Upgrading to version 2.12 fixes the vulnerability.