# CVE-2026-71395: Apache XML Graphics FOP unsafe deserialization in hyphenation loading

Source: https://junglewise.ai/threats/cve-2026-71395-unsafe-deserialization-in-hyphenation-loading-vulnerability-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-71395 · Severity: info · Published 2026-11-11

Apache FOP is an open-source tool for converting XML documents to PDF and other formats. An unsafe deserialization vulnerability in its hyphenation loading feature could allow attackers to execute arbitrary code by providing a malicious hyphenation file. Organizations using FOP to process untrusted XML documents are at risk of code execution and data compromise.

Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-71395 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-71395 being exploited in the wild.

**How severe is CVE-2026-71395?** Informational severity, published 11 November 2026.

**Which products and versions are affected?** Apache XML Graphics FOP through 2.11.

**Is there a fix for CVE-2026-71395?** Yes: fixed in Apache XML Graphics FOP 2.12. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-71395 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-71395?** Check whether you run Apache XML Graphics FOP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Apache XML Graphics FOP 2.12

## Technical details

The vulnerability exists in FOP's HyphenationTree class, which deserializes hyphenation data using ObjectInputStream without proper class whitelisting. An attacker can supply a malicious serialized object in a hyphenation file to achieve remote code execution if the application processes untrusted input. A fix is available in FOP 2.12.

## Affected products

- Apache XML Graphics FOP through 2.11

## Timeline

- 2026-11-11: disclosed

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://issues.apache.org/jira/browse/FOP-3332](https://issues.apache.org/jira/browse/FOP-3332)

## Related threats

- [Apache XML Graphics FOP insecure temporary file permissions](https://junglewise.ai/threats/cve-2026-126627-creation-of-temporary-file-with-insecure-permissions)