CVE-2026-90993

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-90993", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-09-14T14:32:55.692Z", "datePublished": "2026-11-11T10:20:13.294Z", "dateUpdated": "2026-11-11T19:05:35.223Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-11T10:20:13.294Z"}, "title": "Apache XML Graphics Batik: Harden validation in SAXDocumentFactory", "problemTypes": [{"descriptions": [{"description": "CWE-611 Improper restriction of XML external entity reference", "lang": "en", "cweId": "CWE-611", "type": "CWE"}]}], "source": {"defect": ["https://issues.apache.org/jira/browse/BATIK-1399"], "discovery": "UNKNOWN"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache XML Graphics Batik", "packageURL": "pkg:maven/org.apache.xmlgraphics/batik-dom", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "1.19.0", "versionType": "maven"}], "defaultStatus": "unaffected", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.xmlgraphics:batik-dom"}], "descriptions": [{"value": "XXE vulnerability in Apache XML Graphics Batik.\n\n\n\nThis issue affects Apache XML Graphics Batik: through 1.19.\n\n\n\nUsers are recommended to upgrade to version 1.20, which fixes the issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>XXE vulnerability in Apache XML Graphics Batik.</p><p>This issue affects Apache XML Graphics Batik: through 1.19.</p><p>Users are recommended to upgrade to version 1.20, which fixes the issue.</p>"}]}], "references": [{"url": "https://issues.apache.org/jira/browse/BATIK-1399", "tags": ["issue-tracking"]}, {"url": "https://lists.apache.org/thread.html/cnl5g2os5w048h32x50v1xgjnyo8y6vs", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/11/11/20"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-11-11T19:05:35.223Z"}}]}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.xmlgraphics:batik-dom", "packageURL": "pkg:maven/org.apache.xmlgraphics/batik-dom", "product": "Apache XML Graphics Batik", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "1.19.0", "status": "affected", "version": "0", "versionType": "maven"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "XXE vulnerability in Apache XML Graphics Batik.\n\n\n\nThis issue affects Apache XML Graphics Batik: through 1.19.\n\n\n\nUsers are recommended to upgrade to version 1.20, which fixes the issue."}], "id": "CVE-2026-90993", "lastModified": "2026-11-12T17:01:06.913", "metrics": {}, "published": "2026-11-11T11:17:22.293", "references": [{"source": "security@apache.org", "url": "https://issues.apache.org/jira/browse/BATIK-1399"}, {"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/cnl5g2os5w048h32x50v1xgjnyo8y6vs"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/11/11/20"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-611"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "org.apache.xmlgraphics/batik-dom: Apache XML Graphics Batik: Harden validation in SAXDocumentFactory", "id": "2571630", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571630"}, "csaw": false, "cwe": "CWE-611", "details": ["A flaw was found in Apache XML Graphics Batik. An attacker who supplies specially crafted XML input can exploit an XML External Entity (XXE) injection vulnerability, leading to sensitive information disclosure. By forcing the XML parser to resolve external entity references, an attacker may read local system files, access internal network endpoints, or cause a Denial of Service (DoS)."], "name": "CVE-2026-90993", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "java-21-openjdk-portable", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "java-25-openjdk-portable", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-11-11T10:20:13Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-90993\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-90993\nhttps://issues.apache.org/jira/browse/BATIK-1399\nhttps://lists.apache.org/thread.html/cnl5g2os5w048h32x50v1xgjnyo8y6vs"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.19.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache XML Graphics Batik", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "xml_graphics_batik", "vendor": "apache"}], "created": "2026-11-12T04:15:21.834982+00:00", "updated": "2026-11-13T10:15:19.032597+00:00", "vendors": ["apache", "apache$PRODUCT$xml_graphics_batik"]}