AI analysis
Apache OpenNLP's opennlp-spellcheck extension, introduced in 3.0.0-M4 and present in 3.0.0-M5, contains a flaw in SymSpellModelSerializer.create(): the unigramCount and bigramCount 32-bit integers read from a binary SymSpell model stream are passed directly to LinkedHashMap.newLinkedHashMap() with only a non-negative check and no upper bound. An attacker who controls a .bin model file sets either count to Integer.MAX_VALUE (or any heap-exhausting value), causing the map to be pre-sized to 2^30 entries and a 4-8 GB backing array to be allocated on the first put(), crashing the JVM with an OutOfMemoryError; a malicious file of well under 100 bytes plus a single real entry is sufficient. The attacker gains denial of service against any process that deserializes the crafted model, via paths including SymSpellModels.deserialize(InputStream), SymSpellModels.fromBytes(byte[]), classpath loading through SymSpellModelResolver.resolveByLanguage(String), the CorrectTextTool command-line tool, and model-archive loading through the registered ArtifactSerializer. Users running OpenNLP 3.0.0-M4 or 3.0.0-M5 who load SymSpell models from untrusted or semi-trusted origins are affected; OpenNLP 1.x and 2.x releases do not contain the vulnerable code. No public proof-of-concept is known, the issue is not on the CISA KEV list, CVSS scoring is pending, and no in-the-wild exploitation has been reported.
What to do: Upgrade to Apache OpenNLP 3.0.0-M6, which validates both count fields against an upper bound before pre-sizing (default 10,000,000 entries, raisable via the OPENNLP_MAX_ENTRIES system property at JVM startup if you load larger dictionaries; note this property also relaxes the shared model-reader limit). Until you can upgrade, treat SymSpell .bin model files from untrusted or semi-trusted sources as untrusted input and avoid loading them through any affected path - SymSpellModels.deserialize/fromBytes, SymSpellModelResolver, the CorrectTextTool CLI, or ArtifactSerializer-based model archives. Audit where your applications source their spell-check models to confirm no externally supplied models are loaded at startup or runtime.
Affected
| Apache OpenNLP opennlp-spellcheck extension | 3.0.0-M4, 3.0.0-M5 |
Estimated exposure
nichelikely at most a few thousand JVM deployments (milestone pre-release of a niche library extension) — No install-count or internet-scan data exists for this extension; the estimate rests on the fact that the vulnerable code exists only in two milestone (pre-GA) releases of an extension first introduced in 3.0.0-M4, which ships inside…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
OOM Denial of Service via Unbounded Map Pre-Sizing in Apache OpenNLP SymSpellModelSerializer Versions Affected: - 3.0.0-M4 - 3.0.0-M5 (The opennlp-spellcheck extension was introduced in 3.0.0-M4. Releases 1.x and 2.x do not contain the affected code.) Description: The SymSpellModelSerializer.create() method reads two 32-bit signed integer count fields (unigramCount and bigramCount) from a binary SymSpell model stream and passes each value directly to LinkedHashMap.newLinkedHashMap() after validating only that it is non-negative. No upper bound is applied, so the count is fully attacker-controlled when the model file originates from an untrusted source. A crafted .bin model file in which either count field is set to Integer.MAX_VALUE (or any value large enough to exhaust the available heap) causes the map to be pre-sized to a capacity of 2^30 entries. The oversized backing array is allocated on the first put() into that map, requesting 4–8 GB depending on whether compressed oops are in effect, and the load fails with an OutOfMemoryError. Because the count fields sit immediately after a fixed-size header (magic, format version, three UTF strings, the configuration fields, and the edit-distance identifier) the attacker pays no meaningful size cost to weaponize a payload: a file of well under 100 bytes plus a single real entry is sufficient to crash a JVM that loads it. Any code path that deserializes a SymSpell model is affected, including SymSpellModels.deserialize(InputStream), SymSpellModels.fromBytes(byte[]), classpath model loading via SymSpellModelResolver.resolveByLanguage(String), the CorrectTextTool command-line tool, and model-archive loading through the registered ArtifactSerializer. The opennlp-spellcheck extension ships in the official OpenNLP binary distribution. The practical impact is denial of service against processes that load SymSpell model files from untrusted or semi-trusted origins. Mitigation: - 3.x users should upgrade to 3.0.0-M6. Note: The fix applies an upper bound to both count fields, checked before the map is pre-sized; counts that are negative or exceed the bound cause an IOException to be thrown and the read to fail fast with no large allocation. The bound is the existing AbstractModelReader.MAX_ENTRIES limit introduced earlie, which the current change promotes to public visibility so that serializers implementing their own binary format can share it. The default bound is 10,000,000, which is well above the entry counts of legitimate SymSpell dictionaries but far below any value that would threaten heap exhaustion. Deployments that legitimately need to load larger dictionaries can raise the limit at JVM startup by setting the OPENNLP_MAX_ENTRIES system property to the desired positive integer (e.g. -DOPENNLP_MAX_ENTRIES=50000000); invalid or non-positive values fall back to the default. Note that this property is shared with the model-reader limit and raising it relaxes both. Users who cannot upgrade immediately should treat all SymSpell .bin model files as untrusted input unless their provenance is verified, and should avoid loading models supplied by end users or fetched from third-party repositories without integrity checks.