CVE-2026-54082
2 advisories.
Maven/org.verapdf:validation-model CVE-2026-54082: medium 6.5
veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs
Action: Upgrade org.verapdf:validation-model to 1.30.2 (1.30.x) or 1.31.71 (1.31.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.17.35 | 1.30.2 | - |
| 1.31.1 | 1.31.71 | - |
Fixed versions
| 1.30.2 | 1.31.71 |
Sources
- osv: GHSA-cg9x-g3gm-h5h6
- https://github.com/veraPDF/veraPDF-validation/security/advisories/GHSA-cg9x-g3gm-h5h6
- https://github.com/veraPDF/veraPDF-validation/pull/730
- https://github.com/veraPDF/veraPDF-validation/commit/94caa46c1a594512247fbd46c808edae39469542
- https://github.com/veraPDF/veraPDF-validation/commit/cacd9436d0de40b0e58cc7d2dbb06451619e61ec
- https://github.com/veraPDF/veraPDF-validation
CVE-2026-54082 · published · modified · JSON
Maven/org.verapdf:validation-model-jakarta CVE-2026-54082: medium 6.5
veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs
Action: Upgrade org.verapdf:validation-model-jakarta to 1.30.2 (1.30.x) or 1.31.71 (1.31.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.17.35 | 1.30.2 | - |
| 1.31.1 | 1.31.71 | - |
Fixed versions
| 1.30.2 | 1.31.71 |
Sources
- osv: GHSA-cg9x-g3gm-h5h6#Maven/org.verapdf:validation-model-jakarta
- https://github.com/veraPDF/veraPDF-validation/security/advisories/GHSA-cg9x-g3gm-h5h6
- https://github.com/veraPDF/veraPDF-validation/pull/730
- https://github.com/veraPDF/veraPDF-validation/commit/94caa46c1a594512247fbd46c808edae39469542
- https://github.com/veraPDF/veraPDF-validation/commit/cacd9436d0de40b0e58cc7d2dbb06451619e61ec
- https://github.com/veraPDF/veraPDF-validation
CVE-2026-54082 · published · modified · JSON