Apache OpenNLP

Related CVEsby mentions

• CVE-2026-8261710.0—
  ReDoS in Apache OpenNLP built-in EMAIL and URL regex name finders
  CVE-2026-82617 is a regular-expression denial-of-service flaw (CWE-1333, inefficient regex complexity) in the two built-in name-finder patterns, EMAIL and URL, exposed by opennlp.tools.namefind.RegexNameFinderFactory in Apache OpenNLP. An application that obtains these finders via RegexNameFinderFactory.getDefaultRegexNameFinders(...) and applies them to untrusted text through RegexNameFinder.find(String[]) or find(String) can be driven into quadratic backtracking or unbounded matcher recursion by small crafted inputs: roughly 32 KB of text burns several seconds of CPU per EMAIL scan and returns no match, while roughly 4 KB of &-separated URL query tokens exhausts the thread stack and raises java.lang.StackOverflowError (about 1 KB suffices on worker threads with reduced stacks such as -Xss512k). Because no authentication or special configuration is needed, anyone who can control the text fed to these finders can convert each request into seconds to minutes of pinned CPU or abrupt thread death, denying service to the embedding application. Affected are applications embedding Apache OpenNLP 2.0.0 through 2.5.11 or 3.0.0-M1 through 3.0.0-M5 that have selected one of these two built-in finders; the flaw is specific to the built-in EMAIL/URL patterns and does not implicate model-based NER usage. There is no known exploitation, public proof-of-concept, or KEV listing as of now; fixed releases are 2.5.12 and 3.0.0-M6.
  · Apache OpenNLP 2.0.0 through 2.5.11 · Apache OpenNLP 3.0.0-M1 through 3.0.0-M5—
• CVE-2026-672117.5—
  OOM Denial of Service in Apache OpenNLP opennlp-spellcheck 3.0.0-M4/M5
  Apache OpenNLP's opennlp-spellcheck extension, introduced in 3.0.0-M4 and present in 3.0.0-M5, contains a flaw in SymSpellModelSerializer.create(): the unigramCount and bigramCount 32-bit integers read from a binary SymSpell model stream are passed directly to LinkedHashMap.newLinkedHashMap() with only a non-negative check and no upper bound. An attacker who controls a .bin model file sets either count to Integer.MAX_VALUE (or any heap-exhausting value), causing the map to be pre-sized to 2^30 entries and a 4-8 GB backing array to be allocated on the first put(), crashing the JVM with an OutOfMemoryError; a malicious file of well under 100 bytes plus a single real entry is sufficient. The attacker gains denial of service against any process that deserializes the crafted model, via paths including SymSpellModels.deserialize(InputStream), SymSpellModels.fromBytes(byte[]), classpath loading through SymSpellModelResolver.resolveByLanguage(String), the CorrectTextTool command-line tool, and model-archive loading through the registered ArtifactSerializer. Users running OpenNLP 3.0.0-M4 or 3.0.0-M5 who load SymSpell models from untrusted or semi-trusted origins are affected; OpenNLP 1.x and 2.x releases do not contain the vulnerable code. No public proof-of-concept is known, the issue is not on the CISA KEV list, CVSS scoring is pending, and no in-the-wild exploitation has been reported.
  · Apache OpenNLP opennlp-spellcheck extension 3.0.0-M4, 3.0.0-M5niche

Appears with