Opennlp (Apache) - vulnerabilities (CVEs)

8 CVEs, 0 in the last 30 days, 50 known versions, newest CVE from 2026-09-11. Vendor: Apache.

CVEs of Opennlp

• CVE-2026-82617 - CVSS 10 (critical), 2026-09-11: The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULT_REGEX_NAME_FINDER.EMAIL and…
• CVE-2026-67211 - CVSS 7.5 (high), 2026-09-11: OOM Denial of Service via Unbounded Map Pre-Sizing in Apache OpenNLP SymSpellModelSerializer Versions Affected: - 3.0.0-M4 - 3.0.0-M5 (The opennlp-spellcheck…
• CVE-2026-63317 - CVSS 5.6 (medium), 2026-07-24: Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP Versions Affected: - before 2.5.10 - before 3.0.0-M5…
• CVE-2026-43825 - CVSS 7.3 (high), 2026-07-06: Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel Versions Affected:   before 3.0.0-M4 (libsvm document categorization module; introduced in  …
• CVE-2026-42440 - CVSS 7.5 (high), 2026-05-04: OOM Denial of Service via Unbounded Array Allocation in Apache OpenNLP AbstractModelReader  Versions Affected:  before 1.9.5 before 2.5.9 before 3.0.0-M3 …
• CVE-2026-42027 - CVSS 9.8 (critical), 2026-05-04: Arbitrary Class Instantiation via Model Manifest in Apache OpenNLP ExtensionLoader Versions Affected: before 1.9.5, before 2.5.9, before 3.0.0-M3…
• CVE-2026-40682 - CVSS 9.1 (critical), 2026-05-04: XML External Entity (XXE) via Unsanitized Dictionary Parsing in Apache OpenNLP DictionaryEntryPersistor Versions Affected: before 2.5.9, before 3.0.0-M3…
• CVE-2017-12620 - CVSS 9.8 (critical), 2017-10-03: When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only affects…