CVE-2026-42027

Apache OpenNLP is vulnerable to arbitrary class instantiation via its ExtensionLoader component in versions before 1.9.5, 2.5.9, and 3.0.0-M3. The instantiateExtension method uses Class.forName() to load classes based on the manifest.properties entry of a model archive. Because the type check occ...