Maven/org.verapdf:validation-model CVE-2026-54079: high 8.7, EPSS 0.56%
veraPDF Validation XXE via XFA
Action: Upgrade org.verapdf:validation-model to 1.30.2 (1.30.x) or 1.31.71 (1.31.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.17.35 | 1.30.2 | - |
| 1.31.1 | 1.31.71 | - |
Fixed versions
| 1.30.2 | 1.31.71 |
Sources
- osv: GHSA-36mm-w85j-3q2j
- nvd: CVE-2026-54079
- https://github.com/veraPDF/veraPDF-validation/security/advisories/GHSA-36mm-w85j-3q2j
- https://github.com/veraPDF/veraPDF-validation/pull/730
- https://github.com/veraPDF/veraPDF-validation/commit/94caa46c1a594512247fbd46c808edae39469542
- https://github.com/veraPDF/veraPDF-validation/commit/cacd9436d0de40b0e58cc7d2dbb06451619e61ec
- https://github.com/veraPDF/veraPDF-validation
CVE-2026-54079 · published · modified · JSON