UBUNTU-CVE-2026-67211

OOM Denial of Service via Unbounded Map Pre-Sizing in Apache OpenNLP SymSpellModelSerializer Versions Affected: - 3.0.0-M4 - 3.0.0-M5 The opennlp-spellcheck extension was introduced in 3.0.0-M4. Releases 1.x and 2.x do not contain the affected code. Description: The SymSpellModelSerializer.create...

CVE-2026-82617

The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULTREGEXNAMEFINDER.EMAIL and DEFAULTREGEXNAMEFINDER.URL - contain ambiguous nested quantifiers. An application that obtains these finders through RegexNameFinderFactory.getDefaultRegexNameFinders...

CVE-2026-67211

OOM Denial of Service via Unbounded Map Pre-Sizing in Apache OpenNLP SymSpellModelSerializer Versions Affected: - 3.0.0-M4 - 3.0.0-M5 The opennlp-spellcheck extension was introduced in 3.0.0-M4. Releases 1.x and 2.x do not contain the affected code. Description: The SymSpellModelSerializer.create...

CVE-2026-82617 Apache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns

The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULTREGEXNAMEFINDER.EMAIL and DEFAULTREGEXNAMEFINDER.URL - contain ambiguous nested quantifiers. An application that obtains these finders through RegexNameFinderFactory.getDefaultRegexNameFinders...

EUVD-2026-76169

The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULTREGEXNAMEFINDER.EMAIL and DEFAULTREGEXNAMEFINDER.URL - contain ambiguous nested quantifiers. An application that obtains these finders through RegexNameFinderFactory.getDefaultRegexNameFinders...

CVE-2026-82617

Apache OpenNLP versions 2.0.0 through 2.5.11 and 3.0.0-M1 through 3.0.0-M5 are affected by ambiguous nested quantifiers in the built-in EMAIL and URL name-finder patterns of RegexNameFinderFactory. The EMAIL pattern suffers quadratic-time ReDoS: a ~32 KB input without an @ forces re-scanning from...

CVE-2026-82617

The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULTREGEXNAMEFINDER.EMAIL and DEFAULTREGEXNAMEFINDER.URL - contain ambiguous nested quantifiers. An application that obtains these finders through RegexNameFinderFactory.getDefaultRegexNameFinders...

CVE-2026-67211 Apache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializer

OOM Denial of Service via Unbounded Map Pre-Sizing in Apache OpenNLP SymSpellModelSerializer Versions Affected: - 3.0.0-M4 - 3.0.0-M5 The opennlp-spellcheck extension was introduced in 3.0.0-M4. Releases 1.x and 2.x do not contain the affected code. Description: The SymSpellModelSerializer.create...

EUVD-2026-76167

OOM Denial of Service via Unbounded Map Pre-Sizing in Apache OpenNLP SymSpellModelSerializer Versions Affected: - 3.0.0-M4 - 3.0.0-M5 The opennlp-spellcheck extension was introduced in 3.0.0-M4. Releases 1.x and 2.x do not contain the affected code. Description: The SymSpellModelSerializer.create...

CVE-2026-67211

Apache OpenNLP versions 3.0.0-M4 and 3.0.0-M5 are vulnerable to an OOM denial of service in the opennlp-spellcheck extension. The SymSpellModelSerializer.create() method reads two 32-bit count fields from a binary SymSpell .bin model file and passes them directly to LinkedHashMap.newLinkedHashMap...

CVE-2026-67211

OOM Denial of Service via Unbounded Map Pre-Sizing in Apache OpenNLP SymSpellModelSerializer Versions Affected: - 3.0.0-M4 - 3.0.0-M5 The opennlp-spellcheck extension was introduced in 3.0.0-M4. Releases 1.x and 2.x do not contain the affected code. Description: The SymSpellModelSerializer.create...

PT-2026-90004

The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULT REGEX NAME FINDER.EMAIL and DEFAULT REGEX NAME FINDER.URL - contain ambiguous nested quantifiers. An application that obtains these finders through...

CVE-2026-63317

A flaw was found in Apache OpenNLP. This vulnerability allows an attacker to achieve arbitrary class instantiation by providing a specially crafted XML feature generator descriptor within a model archive or by supplying untrusted format names. While not direct remote code execution, successful...

CVE-2026-43825

Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel Versions Affected: before 3.0.0-M4 libsvm document categorization module; introduced in OPENNLP-1808 and only present on the 3.x line Description: SvmDoccatModel.deserializeInputStream reads an attacker-controlled stream with...

UBUNTU-CVE-2026-43825

Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel Versions Affected: before 3.0.0-M4 libsvm document categorization module; introduced in OPENNLP-1808 and only present on the 3.x line Description: SvmDoccatModel.deserializeInputStream reads an attacker-controlled stream with...

EUVD-2026-41885

Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel Versions Affected: before 3.0.0-M4 libsvm document categorization module; introduced in OPENNLP-1808 and only present on the 3.x line Description: SvmDoccatModel.deserializeInputStream reads an attacker-controlled stream with...

CVE-2026-42027

A flaw was found in Apache OpenNLP. An attacker, by providing a specially crafted model archive, can exploit a vulnerability in the ExtensionLoader component. This allows the attacker to force the system to load and initialize any class present on the classpath, executing its static initializer...

SUSE CVE-2026-40682

XML External Entity XXE via Unsanitized Dictionary Parsing in Apache OpenNLP DictionaryEntryPersistor Versions Affected: before 2.5.9, before 3.0.0-M3 Description: The DictionaryEntryPersistor class initializes a static SAXParserFactory at class-load time without enabling FEATURESECUREPROCESSING ...

GHSA-CX4M-2P55-RW7J Apache OpenNLP ExtensionLoader Vulnerable to Arbitrary Class Instantiation via Model Manifest

Versions Affected: before 1.9.5, before 2.5.9, before 3.0.0-M3 Description: The ExtensionLoader.instantiateExtensionClass, String method loads a class by its fully-qualified name via Class.forName and invokes its no-arg constructor, with the class name sourced from the manifest.properties entry o...

UBUNTU-CVE-2026-42440

OOM Denial of Service via Unbounded Array Allocation in Apache OpenNLP AbstractModelReader Versions Affected: before 1.9.5 before 2.5.9 before 3.0.0-M3 Description: The AbstractModelReader methods getOutcomes, getOutcomePatterns, and getPredicates each read a 32-bit signed integer count field fro...