{"action":"Upgrade org.verapdf:validation-model to 1.30.2 (1.30.x) or 1.31.71 (1.31.x) or later.","affected":[{"fixed":"1.30.2","introduced":"1.17.35"},{"fixed":"1.31.71","introduced":"1.31.1"}],"component":"org.verapdf:validation-model","cve_ids":["CVE-2026-54079"],"ecosystem":"Maven","epss":0.00555,"exploited":false,"fixed_versions":["1.30.2","1.31.71"],"ghsa_id":"GHSA-36mm-w85j-3q2j","id":"tcs_01M5N883DAT7YZSCZDV0H7XA1S","modified_at":"2026-07-29T15:27:48.935885Z","published_at":"2026-07-29T15:08:17Z","references":["https://osv.dev/vulnerability/GHSA-36mm-w85j-3q2j","https://github.com/veraPDF/veraPDF-validation/security/advisories/GHSA-36mm-w85j-3q2j","https://github.com/veraPDF/veraPDF-validation/pull/730","https://github.com/veraPDF/veraPDF-validation/commit/94caa46c1a594512247fbd46c808edae39469542","https://github.com/veraPDF/veraPDF-validation/commit/cacd9436d0de40b0e58cc7d2dbb06451619e61ec","https://github.com/veraPDF/veraPDF-validation"],"severity":{"label":"high","score":8.7},"sources":[{"source":"osv","source_id":"GHSA-36mm-w85j-3q2j","url":"https://osv.dev/vulnerability/GHSA-36mm-w85j-3q2j"},{"source":"nvd","source_id":"CVE-2026-54079","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54079"}],"summary":"veraPDF Validation XXE via XFA"}