Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.
Fix
Patch, vendor advisory and mitigation references on NVD 4
- https://lists.apache.org/thread/hco2nw1typoorz33qzs0fcdx0ws6d6j2 Mailing List, Vendor Advisory
- https://xmlgraphics.apache.org/security.html Vendor Advisory
- https://lists.apache.org/thread/hco2nw1typoorz33qzs0fcdx0ws6d6j2 Mailing List, Vendor Advisory
- https://xmlgraphics.apache.org/security.html Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.1 · apache, debianNVD modified 2026-10-08 22:17
Affected (CPE criteria) 2
cpe:2.3:a:apache:xml_graphics_batik:*:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
References 12
- http://www.openwall.com/lists/oss-security/2023/08/22/2 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/08/22/4 Mailing List, Third Party Advisory
- https://lists.apache.org/thread/hco2nw1typoorz33qzs0fcdx0ws6d6j2 Mailing List, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2023/10/msg00021.html Mailing List
- https://security.gentoo.org/glsa/202401-11
- https://xmlgraphics.apache.org/security.html Vendor Advisory
- http://www.openwall.com/lists/oss-security/2023/08/22/2 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/08/22/4 Mailing List, Third Party Advisory
- https://lists.apache.org/thread/hco2nw1typoorz33qzs0fcdx0ws6d6j2 Mailing List, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2023/10/msg00021.html Mailing List
- https://security.gentoo.org/glsa/202401-11
- https://xmlgraphics.apache.org/security.html Vendor Advisory