org.apache.opennlp:opennlp-distr (>=3.0.0-m1, <=3.0.0-m4) potentially affected by CVE-2026-63317 via org.apache.opennlp:opennlp-tools (>=3.0.0-m1, <=3.0.0-m4)

org.apache.opennlp:opennlp-tools MAVEN version =3.0.0-m1, =3.0.0-m1, =3.0.0-m4 Source cves: CVE-2026-63317 Source advisory: MEND:CVE-2026-63317...

org.apache.opennlp:opennlp-cli (>=3.0.0-m2, <=3.0.0-m3), org.apache.opennlp:opennlp-distr (>=3.0.0-m2, <=3.0.0-m3) +2 more potentially affected by CVE-2026-43825 via org.apache.opennlp:opennlp-ml-libsvm (>=3.0.0-m2, <=3.0.0-m3)

org.apache.opennlp:opennlp-ml-libsvm MAVEN version =3.0.0-m2, =3.0.0-m2, =3.0.0-m2, =3.0.0-m2, =3.0.0-m2, =3.0.0-m3 Source cves: CVE-2026-43825 Source advisory: SNYK:JAVA-ORGAPACHEOPENNLP-17875107...

com.intel.analytics.bigdl:bigdl (0.13.0), com.intel.analytics.bigdl:bigdl-assembly-spark_2.4.6 (>=2.0.0, <=2.3.0) +32 more potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (1.8.2)

org.apache.opennlp:opennlp-tools MAVEN version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.opennlp:opennlp-tools and may be impacted: - com.intel.analytics.bigdl:bigdl 0.13.0 - com.intel.analytics.bigdl:bigdl-assembly-spark2.4.6...

org.apache.opennlp:opennlp-brat-annotator (1.7.0), org.apache.opennlp:opennlp-distr (1.7.0) +2 more potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (1.7.0)

org.apache.opennlp:opennlp-tools MAVEN version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.opennlp:opennlp-tools and may be impacted: - org.apache.opennlp:opennlp-brat-annotator 1.7.0 - org.apache.opennlp:opennlp-distr 1.7.0 -...

com.rabidgremlin:mutters-opennlp-intent (>=4.0.0, <=5.0.4), com.rabidgremlin:mutters-opennlp-ner (>=4.0.0, <=5.0.4) +19 more potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (1.8.0)

org.apache.opennlp:opennlp-tools MAVEN version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.opennlp:opennlp-tools and may be impacted: - com.rabidgremlin:mutters-opennlp-intent =4.0.0, =4.0.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0,...

ai.tock:tock-bot-admin-server (>=20.3.0, <=20.3.3), ai.tock:tock-bot-admin-test-core (>=20.3.0, <=20.3.3) +124 more potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (1.9.2)

org.apache.opennlp:opennlp-tools MAVEN version 1.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.opennlp:opennlp-tools and may be impacted: - ai.tock:tock-bot-admin-server =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0,...

ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +884 more potentially affected by CVE-2026-42027 via org.apache.opennlp:opennlp-tools (>=2.0.0, <=2.5.8)

org.apache.opennlp:opennlp-tools MAVEN version =2.0.0, =0.1.0, =0.1.0, =2.12.1, =2.12.1, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.14.0-rc.2 and more Source cves: CVE-2026-42027 Source advisory: GHSA-CX4M-2P55-RW7J...

org.apache.opennlp:opennlp-distr (>=3.0.0-m1, <=3.0.0-m2) potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (>=3.0.0-m1, <=3.0.0-m2)

org.apache.opennlp:opennlp-tools MAVEN version =3.0.0-m1, =3.0.0-m1, =3.0.0-m2 Source cves: CVE-2026-42440 Source advisory: GHSA-659W-93R5-9J6M...

org.apache.opennlp:opennlp-distr (>=3.0.0-m1, <=3.0.0-m2) potentially affected by CVE-2026-42027 via org.apache.opennlp:opennlp-tools (>=3.0.0-m1, <=3.0.0-m2)

org.apache.opennlp:opennlp-tools MAVEN version =3.0.0-m1, =3.0.0-m1, =3.0.0-m2 Source cves: CVE-2026-42027 Source advisory: GHSA-CX4M-2P55-RW7J...

org.apache.opennlp:opennlp-distr (>=3.0.0-m1, <=3.0.0-m2) potentially affected by CVE-2026-42027 via org.apache.opennlp:opennlp-tools (>=3.0.0-m1, <=3.0.0-m2)

org.apache.opennlp:opennlp-tools MAVEN version =3.0.0-m1, =3.0.0-m1, =3.0.0-m2 Source cves: CVE-2026-42027 Source advisory: OSV:GHSA-CX4M-2P55-RW7J...

com.github.paramitamirza:catena (catena), com.github.paramitamirza:catena (>=1.0.1, <=1.0.2) +14 more potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (1.5.2-incubating)

org.apache.opennlp:opennlp-tools MAVEN version 1.5.2-incubating is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.opennlp:opennlp-tools and may be impacted: - com.github.paramitamirza:catena catena - com.github.paramitamirza:catena =1.0.1,...

com.centit.support:centit-es-client (0.1.1806), com.davidbracewell:hermes-examples (>=0.1, <=0.5) +220 more potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (1.6.0)

org.apache.opennlp:opennlp-tools MAVEN version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.opennlp:opennlp-tools and may be impacted: - com.centit.support:centit-es-client 0.1.1806 - com.davidbracewell:hermes-examples =0.1, =0.1,...

fr.vsct.tock:tock-bot-admin-server (>=0.4.0, <=0.6.7), fr.vsct.tock:tock-nlp-admin-server (>=0.4.0, <=0.6.7) +18 more potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (1.8.1)

org.apache.opennlp:opennlp-tools MAVEN version 1.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.opennlp:opennlp-tools and may be impacted: - fr.vsct.tock:tock-bot-admin-server =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.1.0, =0.1...

org.apache.opennlp:opennlp-distr (>=3.0.0-m1, <=3.0.0-m2) potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (>=3.0.0-m1, <=3.0.0-m2)

org.apache.opennlp:opennlp-tools MAVEN version =3.0.0-m1, =3.0.0-m1, =3.0.0-m2 Source cves: CVE-2026-42440 Source advisory: OSV:GHSA-659W-93R5-9J6M...

ae.teletronics.nlp:entityextraction (1.3), ai.driftkit:driftkit-embedding-spring-ai (0.6.0) +1162 more potentially affected by CVE-2026-42027 via org.apache.opennlp:opennlp-tools (>=1.5.2-incubating, <=1.9.4)

org.apache.opennlp:opennlp-tools MAVEN version =1.5.2-incubating, =19.9.0, =19.9.1, =19.9.1, =19.9.0, =19.9.0, =19.9.0, =22.3.2 and more Source cves: CVE-2026-42027 Source advisory: GHSA-CX4M-2P55-RW7J...

cloud.testload:jmeter-clickhouse-listener (2.00), com.bobpaulin.jmeter:aws-include-controller-plugin (0.0.1) +123 more potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (1.9.0)

org.apache.opennlp:opennlp-tools MAVEN version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.opennlp:opennlp-tools and may be impacted: - cloud.testload:jmeter-clickhouse-listener 2.00 -...

ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +884 more potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (>=2.0.0, <=2.5.8)

org.apache.opennlp:opennlp-tools MAVEN version =2.0.0, =0.1.0, =0.1.0, =2.12.1, =2.12.1, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.14.0-rc.2 and more Source cves: CVE-2026-42440 Source advisory: OSV:GHSA-659W-93R5-9J6M...

org.apache.opennlp:opennlp-distr (>=3.0.0-m1, <=3.0.0-m2) potentially affected by CVE-2026-40682 via org.apache.opennlp:opennlp-tools (>=3.0.0-m1, <=3.0.0-m2)

org.apache.opennlp:opennlp-tools MAVEN version =3.0.0-m1, =3.0.0-m1, =3.0.0-m2 Source cves: CVE-2026-40682 Source advisory: GHSA-4V8G-86X5-3VRC...

org.apache.opennlp:opennlp-distr (>=3.0.0-m1, <=3.0.0-m2) potentially affected by CVE-2026-40682 via org.apache.opennlp:opennlp-tools (>=3.0.0-m1, <=3.0.0-m2)

org.apache.opennlp:opennlp-tools MAVEN version =3.0.0-m1, =3.0.0-m1, =3.0.0-m2 Source cves: CVE-2026-40682 Source advisory: OSV:GHSA-4V8G-86X5-3VRC...

XML External Entity (XXE) Injection

Overview org.apache.opennlp:opennlp-tools is an is a machine learning based toolkit for the processing of natural language text. Affected versions of this package are vulnerable to XML External Entity XXE Injection via the create method in the DictionaryEntryPersistor class, which initializes a...