CVE-2026-111792

Not scored yetLast modified Nov 12, 2026

Description

Uncontrolled Recursion vulnerability in Apache XML Graphics Batik.

This issue affects Apache XML Graphics Batik: through 1.19.

Users are recommended to upgrade to version 1.20, which fixes the issue.

Metrics

No CVSS score has been published yet.

Weakness enumeration

CWE-674

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 11, 2026
Last modified
Nov 12, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1117934.3Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. TCVE-2026-11189.8A vulnerability was detected in itsourcecode Society Management System 1.0. Impacted is an unknown function of the file /admin/add_activity.CVE-2026-111806.5Inappropriate implementation in SVG in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafteCVE-2026-1118026.6A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash witCVE-2026-1118048.2Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-suppliCVE-2026-1118058.6Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value. This issue affCVE-2026-1118088.6Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This issue affectCVE-2026-1118099.3Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This issue affects ApachCVE-2026-111816.3Inappropriate implementation in Media Session in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policyCVE-2026-1118107.5Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a requeCVE-2026-1118119.0Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache. CVE-2026-11181210.0Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own c
CVE-2026-111792: Unscored | Vulnix