CVE-2026-42440 vulnerabilities

Vulnerabilities for packages: thingsboard...

com.nikialeksey:arspell-langtool (3.1.0), com.rabidgremlin:mutters (1.3.0) +55 more potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (1.7.2)

org.apache.opennlp:opennlp-tools MAVEN version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.opennlp:opennlp-tools and may be impacted: - com.nikialeksey:arspell-langtool 3.1.0 - com.rabidgremlin:mutters 1.3.0 -...

ae.teletronics.nlp:entityextraction (1.3), ai.mattmann.mnemosyne:cas-crawler (1.11.0) +345 more potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (1.5.3)

org.apache.opennlp:opennlp-tools MAVEN version 1.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.opennlp:opennlp-tools and may be impacted: - ae.teletronics.nlp:entityextraction 1.3 - ai.mattmann.mnemosyne:cas-crawler 1.11.0 -...

ai.stainless:grails-tika (0.1.0), ai.tock:tock-bot-admin-server (>=19.9.0, <=19.9.4) +128 more potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (1.9.1)

org.apache.opennlp:opennlp-tools MAVEN version 1.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.opennlp:opennlp-tools and may be impacted: - ai.stainless:grails-tika 0.1.0 - ai.tock:tock-bot-admin-server =19.9.0, =19.9.1, =19.9.1,...

ae.teletronics.nlp:entityextraction (1.3), ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess (>=0.1.0, <=0.2.0) +1809 more potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (>=1.5.2-incubating, <=2.5.8)

org.apache.opennlp:opennlp-tools MAVEN version =1.5.2-incubating, =0.1.0, =0.1.0, =2.12.1, =2.12.1, =4.13.5, =4.13.5, =4.14.0-rc.2 and more Source cves: CVE-2026-42440 Source advisory: MEND:CVE-2026-42440...

CVE-2026-42440

OOM Denial of Service via Unbounded Array Allocation in Apache OpenNLP AbstractModelReader Versions Affected: before 1.9.5 before 2.5.9 before 3.0.0-M3 Description: The AbstractModelReader methods getOutcomes, getOutcomePatterns, and getPredicates each read a 32-bit signed integer count field...