Skip to content
OpenAdvisories

Package · Ubuntu

apache-opennlp

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • Critical 10.0
    CVE-2026-82617

    Apache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns

    The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULT_REGEX_NAME_FINDER.EMAIL and DEFAULT_REGEX_NAME_FINDER.URL - contain ambiguous nested quantifiers. An application that obtains these finders through RegexN…

    Apache Software Foundation Apache OpenNLP apache-opennlp apache-opennlp Debian Ubuntu
  • High 7.5
    CVE-2026-67211

    Apache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializer

    OOM Denial of Service via Unbounded Map Pre-Sizing in Apache OpenNLP SymSpellModelSerializer Versions Affected: - 3.0.0-M4 - 3.0.0-M5 (The opennlp-spellcheck extension was introduced in 3.0.0-M4. Releases 1.x and 2.x do not contain the affected code.) Descrip…

    Apache Software Foundation Apache OpenNLP apache-opennlp Ubuntu
  • Medium 5.6
    CVE-2026-63317

    Apache OpenNLP: Arbitrary Class Instantiation in GeneratorFactory via Feature Descriptor XML

    Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP Versions Affected: - before 2.5.10 - before 3.0.0-M5 Description: Three code paths in Apache OpenNLP load a class by its fully-qualified name via Class.forNam…

    Apache Software Foundation Apache OpenNLP apache-opennlp apache-opennlp Debian Ubuntu
  • High 7.3
    CVE-2026-43825 EPSS 14%

    Apache OpenNLP :: Core :: ML :: LibSVM: Unsafe Java Deserialization in SvmDoccatModel

    Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel Versions Affected:   before 3.0.0-M4 (libsvm document categorization module; introduced in   OPENNLP-1808 and only present on the 3.x line) Description: SvmDoccatModel.deserialize(InputStream) re…

    Apache Software Foundation Apache OpenNLP :: Core :: ML :: LibSVM apache-opennlp Ubuntu
  • Critical 9.1
    CVE-2026-40682

    Apache OpenNLP: XXE via Dictionary Parsing in DictionaryEntryPersistor

    XML External Entity (XXE) via Unsanitized Dictionary Parsing in Apache OpenNLP DictionaryEntryPersistor Versions Affected: before 2.5.9, before 3.0.0-M3 Description: The DictionaryEntryPersistor class initializes a static SAXParserFactory at class-load time w…

    Apache Software Foundation Apache OpenNLP apache-opennlp apache-opennlp Debian Ubuntu Maven
  • Critical 9.8
    CVE-2026-42027

    Apache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoader

    Arbitrary Class Instantiation via Model Manifest in Apache OpenNLP ExtensionLoader Versions Affected: before 1.9.5, before 2.5.9, before 3.0.0-M3 Description:  The ExtensionLoader.instantiateExtension(Class, String) method loads a class by its fully-qualified…

    Apache Software Foundation Apache OpenNLP apache-opennlp apache-opennlp Debian Ubuntu Maven
  • High 7.5
    CVE-2026-42440

    Apache OpenNLP: OOM DoS via Unbounded Array Allocation in AbstractModelReader

    OOM Denial of Service via Unbounded Array Allocation in Apache OpenNLP AbstractModelReader  Versions Affected:  before 1.9.5 before 2.5.9 before 3.0.0-M3  Description: The AbstractModelReader methods getOutcomes(), getOutcomePatterns(), and getPredicates() ea…

    Apache Software Foundation Apache OpenNLP apache-opennlp apache-opennlp Debian Ubuntu Maven