A dependency scan on a build with Open HTML to PDF can report Batik, PDFBox or Commons IO advisories, even though NVD, OSV and GitHub's database list no CVE for the renderer's own jars. That scan result leads this post on 1.1.108, the 1 November 2026 release of the community fork under the io.github.openhtmltopdf group ID. Flex rows, fonts, base URIs and XHTML parsing follow, tested on Java 17 or traced to the README and wiki on 4 November 2026.

We work at Iron Software, and the end of this article covers our library, IronPDF.

Which CVEs Reach a Build Through Its Dependencies

A search of the three main advisory sources (NVD, OSV and GitHub's database) on 4 November 2026 found no CVE for the renderer's own jars, under the old or the new group ID. The records a scanner reports come in with the modules' dependencies. CVSS 3.1 base scores below are from NVD, with the scorer named.

  • CVE-2022-38398 and CVE-2022-38648, score 5.3 Medium (NIST): Server-side request forgery in Batik 1.14, fixed in Batik 1.15.
  • CVE-2022-40146, score 7.5 High (NIST): Request forgery in Batik 1.14 that reaches files through a Jar URL, fixed in 1.15.
  • CVE-2022-42890, score 7.5 High (NIST): Untrusted SVG runs Java code through JavaScript in Batik before 1.16.
  • CVE-2022-41704, score 7.5 High (NIST): Untrusted Java code runs from an SVG in Batik before 1.16.
  • CVE-2022-44729 and CVE-2022-44730, scores 7.1 High and 4.4 Medium (NIST): Request forgery in Batik up to 1.16, fixed in 1.17.
  • CVE-2022-34169, score 7.5 High (NIST): Integer truncation in Xalan through 2.7.2 when it processes a malicious XSLT stylesheet.
  • CVE-2026-33929, score 4.3 Medium (CISA-ADP): Path traversal through the ExtractEmbeddedFiles example shipped with PDFBox 2.0.24 to 2.0.36 and 3.0.0 to 3.0.7, fixed in 2.0.37 and 3.0.8.
  • CVE-2024-47554, score 4.3 Medium (CISA-ADP): CPU exhaustion in XmlStreamReader in Commons IO before 2.14.0.
  • CVE-2021-29425, score 4.8 Medium (NIST): Limited path traversal in FilenameUtils.normalize in Commons IO before 2.7.

The seven Batik records apply to the com.openhtmltopdf 1.0.10 SVG module, which depends on Batik 1.14, and that group ID has had no newer release. The Xalan record reaches the same module, through Xalan 2.7.2 from batik-dom 1.14. The PDFBox record applies to 1.0.10, which uses PDFBox 2.0.24, and to every fork build on Maven Central before 1.1.100, which used PDFBox 3.0.2 to 3.0.7. GitHub's advisory files that example under the separate pdfbox-examples artifact, but scanners that read NVD match on the PDFBox version even though the renderer never calls that example. CVE-2024-47554 applies to 1.1.108 as well, since its SVG module resolves commons-io 2.11.0 through xmlgraphics-commons 2.9, while OSV's range for CVE-2021-29425 takes in the commons-io 1.3.1 that the 1.0.10 SVG module gets from xmlgraphics-commons 2.6. Seven newer Batik CVEs sit outside those databases. Apache's security page rates them medium, ties them to the 1.20 release of 20 October 2026 and scopes them to 1.19 and older, so the Batik 1.17 that the 1.1.108 module uses falls in that range, with no NVD or OSV entry as of 4 November 2026. The library's own mitigations are Batik 1.17 and PDFBox 3.0.8 in 1.1.108 and a default BatikSVGDrawer that blocks scripts and external requests inside SVG, and a dependencyManagement entry in the Maven build can lift Commons IO to a fixed 2.14.0 or newer.

A Flex Row Stacks Instead of Sitting Side by Side

Two panels in a flex row are the usual shape of a dashboard card.

import com.openhtmltopdf.pdfboxout.PdfRendererBuilder; import java.io.File; import java.io.FileOutputStream; import java.io.OutputStream; public class FlexPanelsRow { public static void main(String[] args) throws Exception { // Two flex:1 panels meant to sit side by side, the shape of a dashboard card row. String panel = "flex: 1; height: 600px; border: 1px solid #999;"; String html = "<html><body><div style=\"display: flex; gap: 12px;\">" + "<div style=\"" + panel + "\">Renewals due in Q1</div>" + "<div style=\"" + panel + "\">Renewals due in Q2</div>" + "</div></body></html>"; try (OutputStream out = new FileOutputStream("renewal-panels.pdf")) { PdfRendererBuilder builder = new PdfRendererBuilder(); builder.withHtmlContent(html, new File(".").toURI().toString()); builder.toStream(out); builder.run(); } } }

In 1.1.108 the log reported that flex is not a recognized identifier, ignored gap and both flex declarations, and laid the panels out in block flow. Each panel took the full body width, the Q2 panel started partway down page one, and its border ran onto a second A4 page. According to the README's DISCLAIMER section, flex and grid layouts are unsupported, JavaScript is ignored everywhere in the code, and the suggested substitutes are HTML tables or floated inline blocks. A template built on a flex row or a grid needs that rewrite before it prints, and anything a page script draws or fills in, from a total to a JavaScript chart, has to be produced in Java first.

Text Outside Western European Scripts Needs a Font File

With no font registered, text falls back to the PDF built-in fonts.

import com.openhtmltopdf.pdfboxout.PdfRendererBuilder; import java.io.FileOutputStream; import java.io.OutputStream; public class GreekWithoutFont { public static void main(String[] args) throws Exception { // No font is registered, so the text falls back to the built-in PDF fonts. String html = "<html><body><p>Invoice / Τιμολόγιο 2048</p></body></html>"; try (OutputStream out = new FileOutputStream("greek.pdf")) { PdfRendererBuilder builder = new PdfRendererBuilder(); builder.withHtmlContent(html, null); builder.toStream(out); builder.run(); } } }

Nothing in the log mentioned the missing glyphs, and the PDF's text layer read Invoice / ######### 2048, with each of the nine Greek letters replaced by the # character. The project's Fonts wiki explains that the built-in fonts cover only a basic Western European character set and that a character with no glyph becomes the replacement character. Any document with Greek, Cyrillic, Arabic or Asian text needs a font file registered through useFont or @font-face, and the README rules out OpenType, so the file has to be TrueType. PDF/A and PDF/UA output bar the built-in fonts entirely, and PDF/A also needs an ICC profile that the project does not ship.

Relative Images Need a Base URI, and Markup Needs to Be XHTML

withHtmlContent takes the markup and a base URI. Passing null is legal, and nothing stops the render.

import com.openhtmltopdf.pdfboxout.PdfRendererBuilder; import java.io.FileOutputStream; import java.io.OutputStream; public class MissingBaseUri { public static void main(String[] args) throws Exception { String html = "<html><body>" + "<img src=\"images/logo.png\" alt=\"Company logo\" />" + "<p>Statement for October 2026</p></body></html>"; try (OutputStream out = new FileOutputStream("no-base.pdf")) { PdfRendererBuilder builder = new PdfRendererBuilder(); // No base URI, so the relative image path has nothing to resolve against. builder.withHtmlContent(html, null); builder.toStream(out); builder.run(); } } }

The log printed Couldn't resolve relative URI(images/logo.png) because no base URI was provided three times, and the PDF came out with the text and no image. The program exits normally, so the missing logo shows up only when someone opens the file. The fix is a base URI such as the working folder's file: URI, or withFile, which uses the file's own location.

Markup has its own entry condition. The renderer's parser is an XML parser, and a test HTML5 letter with an unclosed <meta> tag stopped withFile with an XRRuntimeException at line 7, column 3, leaving a zero-byte PDF. The README recommends parsing such files with Jsoup first and passing the renderer a Document, which adds Jsoup to the build, and Jsoup's result has to be converted to the org.w3c.dom.Document that withW3cDocument takes.

Release History of the Two Coordinates

The last com.openhtmltopdf release is 1.0.10, dated 13 September 2021, and danfickle's original repository, unarchived, has had no commit on its default branch since 1 April 2022. Because the fork's pipeline releases each push to main that changes more than Markdown files, its 103 versions count pushes and say little about the size of any one change. It went from 1.1.37 on 21 January 2026 to 1.1.38 on 3 July 2026 with nothing in between, then published 70 more by 1 November 2026. The wiki the README links is still hosted on the old repository and marked as not yet migrated, and the online sandbox carries a 1.0.10 label in the README. The project is distributed under LGPL-2.1-or-later.

Summing Up the Checks

Open HTML to PDF needs flex and grid layouts rewritten, page scripts replaced, TrueType fonts registered for non-Latin text and for PDF/A, a base URI for relative images and well-formed XHTML input, and its dependency tree carries Batik, Xalan, PDFBox or Commons IO advisories depending on the build. For templates that come from a web front end, IronPDF for Java is a commercial alternative from Iron Software that renders that markup through Chromium.

In our runs on 2026.11.3, two renewal panels stayed side by side in a flex row, a grid row took its reference from a page script with a WaitFor delay, and a string with &nbsp; and unclosed tags rendered with no Jsoup step. An @font-face rule embedded its TrueType file in another run, the Google Fonts example shows the web-font route, and the PDF/A guide converts after rendering, with PDF/A-1, 2 and 3 output passing veraPDF in our run.

The library is declared as com.ironsoftware:ironpdf, and Maven Central carries eleven 2026 builds of it, from 2026.1.3 to 2026.11.3 on 3 November 2026. A free trial covers running your own templates before any purchase.

Open HTML to PDF, Apache PDFBox, Apache Batik, Apache Xalan, Apache Commons IO and Jsoup remain the property of their owners, we have no affiliation with those projects, and what we say about them is based on their READMEs, wiki pages, Apache's security page, Maven Central metadata and the NVD, OSV and GitHub records.

Drafted with AI. Code run and claims checked by the Iron Software DevRel team against Open HTML to PDF 1.1.108, with IronPDF APIs checked against com.ironsoftware:ironpdf 2026.11.3, on 4 November 2026.