Security Bulletin: IBM SPSS Modeler is affected by vulnerabilities in Apache OpenNLP

Summary IBM SPSS Modeler is affected by vulnerabilities in Apache OpenNLP. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-63317 DESCRIPTION: Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP Versions...

RHLW-2026-2AEBDB8547D9B041 Lightwell Security Advisory: opennlp-tools 2.5.9.rhlw-00002

Red Hat Lightwell has released org.apache.opennlp:opennlp-tools 2.5.9.rhlw-00002 with a backported security fix. CVE-2026-63317: Apache OpenNLP: Arbitrary Class Instantiation in GeneratorFactory via Feature Descriptor XML This patched artifact is a drop-in replacement for...

CVE-2026-63317

Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP Versions Affected: - before 2.5.10 - before 3.0.0-M5 Description: Three code paths in Apache OpenNLP load a class by its fully-qualified name via Class.forName and invoke its no-arg constructor...

CVE-2026-63317: Use of Externally-Controlled Input to Select Classes or Code

Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP Versions Affected: - before 2.5.10 - before 3.0.0-M5 Description: Three code paths in Apache OpenNLP load a class by its fully-qualified name via Class.forName and invoke its no-arg constructor...