CVE-2026-40682

Apache OpenNLP is vulnerable to XML External Entity (XXE) injection in the DictionaryEntryPersistor class (versions before 2.5.9 and 3.0.0-M3). The root cause is the initialization of a static SAXParserFactory without enabling FEATURE_SECURE_PROCESSING or disabling DTD processing. Because the pub...

CVE-2026-42440

Apache OpenNLP is vulnerable to an OOM Denial of Service due to unbounded array allocation in the AbstractModelReader component. The methods getOutcomes(), getOutcomePatterns(), and getPredicates() read 32-bit signed integer count fields from a binary model stream and pass them directly to array ...

CVE-2026-42027

Arbitrary Class Instantiation via Model Manifest in Apache OpenNLP ExtensionLoader Versions Affected: before 1.9.5, before 2.5.9, before 3.0.0-M3 Description: The ExtensionLoader.instantiateExtension(Class, String) method loads a class by its fully-qualified name via Class.forName() and invokes i...

CVE-2026-63317

Apache OpenNLP versions before 2.5.10 and before 3.0.0-M5 are vulnerable to arbitrary class instantiation because three code paths use Class.forName() to load classes without validating the class name or type. The affected components are: GeneratorFactory : Parses class attributes from XML featur...