CVE-2022-44729: apache software foundation apache xml graphics batik Server-Side Request Forgery (SSRF)
Vulnerability summary
CVE-2022-44729 is a high (CVSS 7.1) Server-Side Request Forgery (SSRF) vulnerability in apache software foundation apache xml graphics batik. EPSS estimates a 0.92% chance of exploitation in the next 30 days, higher than 59.5% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 3 · Related 2Timeline
- 22-08-2023PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
- OSV · MavenEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
EPSS trend
Probability
0.92%
Chance of exploitation in the next 30 days
Percentile
60%
Versus all other CVEs
30-day change
0.00 pp
From 0.92% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Org.apache.xmlgraphics3 products
- batik-bridge≥ 1.0, < 1.17
- batik-svgrasterizer≥ 1.0, < 1.17
- batik-transcoder≥ 1.0, < 1.17
Debian2 products
- batik< 1.16+dfsg-1+deb12u1 | < 1.17+dfsg-1
- debian_linuxEOL10.0
Apache1 product
- xml_graphics_batik≥ 1.0, ≤ 1.16
Apache software foundation1 product
Ubuntu1 product
- batikAll versions (No fix recorded)
5 vendors · 8 products
