Bug 2571630 (CVE-2026-90993)

Summary: CVE-2026-90993 org.apache.xmlgraphics/batik-dom: Apache XML Graphics Batik: Harden validation in SAXDocumentFactory
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Apache XML Graphics Batik. An attacker who supplies specially crafted XML input can exploit an XML External Entity (XXE) injection vulnerability, leading to sensitive information disclosure. By forcing the XML parser to resolve external entity references, an attacker may read local system files, access internal network endpoints, or cause a Denial of Service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-11 10:31:12 UTC 
XXE vulnerability in Apache XML Graphics Batik.



This issue affects Apache XML Graphics Batik: through 1.19.



Users are recommended to upgrade to version 1.20, which fixes the issue.