{"affected":[{"defaultStatus":"unaffected","ecosystem":"maven","packageName":"org.apache.xmlgraphics:fop-core","product":"Apache XML Graphics FOP","source":"CNA: apache","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"2.11.0","status":"affected","version":"0","versionType":"maven"}]}],"cveId":"CVE-2026-71395","cwes":["CWE-502"],"description":"unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOP.\n\n\n\nThis issue affects Apache XML Graphics FOP: through 2.11.\n\n\n\nUsers are recommended to upgrade to version 2.12, which fixes the issue.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1794408834218,"publishedAt":1794408834218,"references":[{"source":"CNA: apache","tags":["issue-tracking"],"url":"https://issues.apache.org/jira/browse/FOP-3332"},{"source":"CNA: apache","tags":["vendor-advisory"],"url":"https://lists.apache.org/thread.html/nsb89to1r0vzdh3t4w7x10q4z3xk5jqf"}],"remediation":[],"revision":"22558081befda93e34fe843ad2dca0a9df85c43e55fa1a46924099160fa45a87","sources":[{"modifiedAt":1794408834218,"name":"CNA: apache","retrievedAt":1794409742590,"url":"https://www.cve.org/CVERecord?id=CVE-2026-71395"}],"ssvc":null,"status":"published","title":"Apache XML Graphics FOP: CWE-502 unsafe deserialization in hyphenation loading","updatedAt":1794409742590}