Security Bulletin: IBM SPSS Modeler is affected by vulnerabilities in Apache OpenNLP

Summary IBM SPSS Modeler is affected by vulnerabilities in Apache OpenNLP. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-63317 DESCRIPTION: Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP Versions...

CVE-2026-63317

Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP Versions Affected: - before 2.5.10 - before 3.0.0-M5 Description: Three code paths in Apache OpenNLP load a class by its fully-qualified name via Class.forName and invoke its no-arg constructor...

CVE-2026-63317: Use of Externally-Controlled Input to Select Classes or Code

Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP Versions Affected: - before 2.5.10 - before 3.0.0-M5 Description: Three code paths in Apache OpenNLP load a class by its fully-qualified name via Class.forName and invoke its no-arg constructor...