UBUNTU-CVE-2026-89326: Medium severity ubuntu/batik vulnerability

Published Nov 12, 2026

Updated

Origin Validation Error vulnerability in Apache XML Graphics Batik: the external resource same-origin check does not compare the URL protocol This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.

Affected Software

7 affected components

ubuntu/batik*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache XML Graphics Batik to a version that resolves this vulnerability.
Fixed in 1.20

Event History

Nov 12, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which Batik versions are affected and what version fixes the issue?

Apache XML Graphics Batik versions through 1.19 are affected. Upgrade to version 1.20, which fixes the protocol comparison in the external-resource same-origin check.

What condition is involved in exploiting this vulnerability?

The issue concerns Batik's validation of external resources under its same-origin policy. The check does not compare the URL protocol, so exposure is tied to processing external resource URLs where protocol differences matter.