A Maven build that pulls classic-core, an invoice header written as a flex row, and a statement guarded by an open password look like routine jobs for Pentaho Reporting's classic engine. Each of them has a catch in the 11.0 line, and this post walks through all three plus the CVEs in its dependency tree. Our test build came from 11.0.0.4-325, committed on 30 October 2026. GitHub's newest service-pack tag on 4 November 2026 is 11.0.0.4-328, three commits later, with the dependency versions below unchanged. Every snippet below ran on JDK 17, and we opened each resulting PDF to check it. The same snippets gave matching output on a build from 11.0.0.0-237, the top 11.0.0.0 tag, committed on 30 December 2025.
We work at Iron Software, and the end of this article covers our library, IronPDF.
What Does Maven Need Before classic-core Will Resolve?
Repository credentials, or a source build. Neither classic-core nor the eleven org.pentaho.reporting.library modules it depends on is on Maven Central, where every lookup returned 404 on 4 November 2026. Following the README leads to Pentaho's Artifactory at repo.pentaho.com/artifactory/pnt-mvn/, configured through a settings.xml in Pentaho's maven-parent-poms repository, and it refused the 11.0 POMs with HTTP 401 when Maven and curl sent no credentials. Build servers limited to Maven Central stop here, which is why the classes for this post came from the GitHub tag. Our source build skipped 46 core files, the database connection, SQL data factory and query editor code, because parts of it need commons-database-model and rsyntaxtextarea 1.3.2, which are missing from Central too, and no snippet below touches them.
Check the JDK as well. The README still names Java 11 as the minimum, yet release.jdk.version is 17 in the 11.0 parent POM, and Java 11 cannot load classes compiled for release 17. The overview of Maven and the POM explains the repository lookup a build makes.
What Happens to a Flexbox Invoice Header in an HTML Text Field?
The flex layout disappears, and so does the script's output. Pentaho Reporting reads no HTML pages. Markup is only allowed inside a text element flagged as text/html through AttributeNames.Core.RICH_TEXT_TYPE, and HtmlRichTextConverter then hands it to HTMLEditorKit from Java Swing, a kit whose Oracle javadoc says it covers HTML version 3.2 with some extensions.
import org.pentaho.reporting.engine.classic.core.AttributeNames; import org.pentaho.reporting.engine.classic.core.ClassicEngineBoot; import org.pentaho.reporting.engine.classic.core.Element; import org.pentaho.reporting.engine.classic.core.MasterReport; import org.pentaho.reporting.engine.classic.core.elementfactory.LabelElementFactory; import org.pentaho.reporting.engine.classic.core.modules.output.pageable.pdf.PdfReportUtil; public class HtmlInvoiceHeader { public static void main(String[] args) throws Exception { ClassicEngineBoot.getInstance().start(); // An invoice header as a web template would write it, with a flex row and a script-filled date. String header = "<html><head><style>" + ".bar { display: flex; justify-content: space-between; }" + "</style></head><body>" + "<div class='bar'><span>ACME Supplies</span><span>Invoice INV-2041</span></div>" + "<p>Issued <span id='issued'>DATE</span></p>" + "<script>document.getElementById('issued').textContent = '26 October 2026';</script>" + "</body></html>"; LabelElementFactory factory = new LabelElementFactory(); factory.setText(header); factory.setMinimumWidth(500f); factory.setMinimumHeight(80f); Element label = factory.createElement(); // Marking the label as text/html sends it through the engine's rich-text converter. label.setAttribute(AttributeNames.Core.NAMESPACE, AttributeNames.Core.RICH_TEXT_TYPE, "text/html"); MasterReport report = new MasterReport(); report.getReportHeader().addElement(label); PdfReportUtil.createPDF(report, "invoice-header.pdf"); } } Look at invoice-header.pdf and the company name and invoice number share one line, glued together as ACME SuppliesInvoice INV-2041 from the left margin, so justify-content: space-between did nothing. Below it, Issued DATE still shows the placeholder the script was meant to overwrite. Front-end teams that already keep invoices as web templates are the ones affected. Pentaho's answer is one report element per value, laid out in Report Designer or from Java, while the HTML template tutorial keeps the markup as it is.
Does an Open Password Alone Protect a Pentaho PDF?
Not in the test below. Encryption comes in two strengths, 40bit and 128bit, and both produced RC4 here (revision 2 and revision 3 of the standard handler), an algorithm qpdf's encryption notes list as deprecated in PDF 2.0. If the configuration has no OwnerPassword, PdfDocumentWriter writes the PDF padding constant in its place, and a comment in that class says this amounts to an empty password, which Adobe accepts.
import java.io.File; import org.pentaho.reporting.engine.classic.core.ClassicEngineBoot; import org.pentaho.reporting.engine.classic.core.MasterReport; import org.pentaho.reporting.engine.classic.core.elementfactory.LabelElementFactory; import org.pentaho.reporting.engine.classic.core.modules.output.pageable.pdf.PdfReportUtil; import org.pentaho.reporting.libraries.base.config.ModifiableConfiguration; public class OpenPasswordOnly { private static final String PDF = "org.pentaho.reporting.engine.classic.core.modules.output.pageable.pdf."; public static void main(String[] args) throws Exception { ClassicEngineBoot.getInstance().start(); LabelElementFactory line = new LabelElementFactory(); line.setText("Payroll summary, October 2026"); line.setMinimumWidth(300f); line.setMinimumHeight(20f); MasterReport report = new MasterReport(); report.getReportHeader().addElement(line.createElement()); // An open password and a copy ban, but no OwnerPassword key. ModifiableConfiguration config = report.getReportConfiguration(); config.setConfigProperty(PDF + "Encryption", "128bit"); config.setConfigProperty(PDF + "UserPassword", "payroll-2026"); config.setConfigProperty(PDF + "AllowCopy", "false"); PdfReportUtil.createPDF(report, new File("payroll-open-password.pdf")); } } With payroll-2026 the file opens as expected. An empty string opened it too, with every owner permission, in both pypdf and the OpenPDF reader, and pypdf then saved a decrypted copy reading Payroll summary, October 2026. MuPDF was the exception and prompted for the password. This matters to anyone who sets UserPassword by itself on HR or finance output, and supplying an OwnerPassword alongside it closes the gap. Signing and PDF/A have no configuration key in the PDF module, so an export cannot request either. The security and metadata example sets an open password and a permissions password side by side.
Which CVEs Ship With the 11.0 Dependency Tree?
These entries come from OSV and NVD, queried on 4 November 2026 and matched to the compile-scope dependencies of classic-core and its library modules. They are a selection, and CVE.org holds 47 records across the Bouncy Castle Java modules on 1.78.1, none of them on 1.86. Scores follow NVD and name who assigned them, all under CVSS 3.1 apart from Guava's CVSS 4.0, and NVD flags none of the entries as disputed. Each bullet gives the component at 11.0.0.0-237, the release that fixes it and its state in 11.0.0.4-325.
- CVE-2026-8763, 9.1 Critical (NIST): Affects
bcprov-jdk15to181.78.1, fixed in 1.85, and cleared by 1.86 in 11.0.0.4-325. - CVE-2026-13506, 7.5 High (NIST): Affects the same
bcprov-jdk15to18, also fixed in 1.85 and cleared by 1.86. - CVE-2025-31672, 5.3 Medium (CISA-ADP): Affects
poi-ooxml5.2.5, fixed in 5.4.0, and cleared by 5.5.1. - CVE-2025-66453, 7.5 High (NIST): Affects
rhino1.7.13, fixed in 1.7.14.1, and cleared by 1.7.15.1. - CVE-2026-102554, 8.2 High (Google): Affects
guava32.1.2-jre, fixed in 33.7.2, and still open because 11.0.0.4-325 keeps that version. - CVE-2026-34478 and CVE-2026-34480, 7.5 High (NIST): Affects
log4j-core2.23.1, fixed in 2.25.4, and still open at 2.25.3. - CVE-2026-34477, 5.9 Medium (NIST): Also
log4j-core2.23.1 and fixed in 2.25.4, with 2.25.3 still inside the range. - CVE-2026-49844, 5.9 Medium (NIST): Affects
log4j-api2.23.1, fixed in 2.25.5, and 2.25.3 has not reached that fix. - CVE-2025-48924, 5.3 Medium (CISA-ADP): Affects
commons-lang33.14.0, fixed in 3.18.0, and still open because 11.0.0.4-325 keeps 3.14.0.
classic-core declares bcmail-jdk15to18 directly, which is how Bouncy Castle gets in, and Rhino is declared by classic-core and by libloader. In Rhino's case, a crafted number passed to toFixed() can pin the CPU. classic-core declares Guava directly too, and that entry concerns memory allocation while deserializing its CompactHashMap, CompactHashSet and MapMakerInternalMap types, with NVD still listing it as awaiting analysis. The three Log4j Core entries need a particular setup to matter, Rfc5424Layout for log injection, XmlLayout for unsanitized characters and a TLS socket whose verifyHostName setting is silently ignored. OSV lists nothing against OpenPDF 1.3.32. GitHub's newer 11.1.0.0 build tags, from 11.1.0.0-343 onward, already carry Log4j 2.25.5, outside the Log4j ranges above, though 11.1.0.0-461, the newest on 4 November 2026, still pins Guava 32.1.2-jre. A dependencyManagement pin can override these versions as a stopgap, with regression testing on a set Pentaho never released.
Replacing the Pentaho PDF Path for HTML Reports
The engine drops flexbox and script from HTML text, writes RC4 files that pypdf and the OpenPDF reader reopen with an empty password when no OwnerPassword is set, carries Log4j advisories into the 11.0.0.4 service pack, and comes from a repository that answered 401 to Maven and curl requests without credentials.
Where the invoice already exists as an HTML page, IronPDF for Java renders it in full Chromium, and in our 2026.11.3 run the header above put ACME Supplies and Invoice INV-2041 at opposite edges and showed Issued 26 October 2026, with setEnableJavaScript(true) set on ChromePdfRenderOptions. Maven Central carries it as com.ironsoftware:ironpdf, version 2026.11.3 from 3 November. Its setPassword alone also wrote RC4, at 128 bits, and pypdf and MuPDF both refused the empty password. In another run, SecurityOptions with PdfEncryptionType.AES_256 and distinct user and owner passwords wrote an AES-256 file.
IronPDF for Java has a free trial for running these documents against your own templates, and the signing guide covers the digital signatures the Pentaho PDF module has no key for.
Pentaho, OpenPDF, Apache POI, Apache Commons Lang, Log4j, Bouncy Castle, Guava and Rhino are trademarks of their respective owners, we have no affiliation with any of them, and the details here come from the Pentaho Reporting repository, NVD, OSV, CVE.org, qpdf's documentation, Oracle's Java documentation and Maven Central.
Drafted with AI. Pentaho Reporting code run on the 11.0.0.4-325 engine and claims checked by the Iron Software DevRel team on 4 November 2026, with com.ironsoftware:ironpdf 2026.11.3 as the IronPDF reference.
