CVE-2026-63317

CVE-2026-63317 affects Apache OpenNLP versions before 2.5.10 and before 3.0.0-M5. The vulnerability arises from three code paths that load a class by its fully-qualified name via Class.forName() without validating the class name or type: (1) GeneratorFactory reading the class attribute in XML fea...