CVE-2026-63317

A flaw was found in Apache OpenNLP. This vulnerability allows an attacker to achieve arbitrary class instantiation by providing a specially crafted XML feature generator descriptor within a model archive or by supplying untrusted format names. While not direct remote code execution, successful...

PT-2026-64261

Name of the Vulnerable Software and Affected Versions Apache OpenNLP versions prior to 2.5.10 Apache OpenNLP versions prior to 3.0.0-M5 Description Three code paths allow arbitrary class instantiation by loading a class via its fully-qualified name using Class.forName and invoking its no-arg...