CVE-2026-63317

Apache OpenNLP versions before 2.5.10 and before 3.0.0-M5 are vulnerable to arbitrary class instantiation because three code paths use Class.forName() to load classes without validating the class name or type. The affected components are: GeneratorFactory : Parses class attributes from XML featur...