CVE-2026-82617: Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns
Apache OpenNLP CVE-2026-82617: built-in EMAIL and URL regex name-finder patterns enable regular expression denial-of-service and stack exhaustion in affected releases.
CVE-2026-82617 affects Apache OpenNLP opennlp-core 3.0.0-M1 before 3.0.0-M6 and opennlp-tools 2.0.0 before 2.5.12. The DEFAULT_REGEX_NAME_FINDER.EMAIL and DEFAULT_REGEX_NAME_FINDER.URL patterns in RegexNameFinderFactory contain ambiguous nested quantifiers. Applications using these built-in finders on attacker-controlled input can be forced into regular expression denial of service or stack exhaustion. Fixes shipped in opennlp-tools 2.5.12 and 3.0.0-M6.
- Affects opennlp-core 3.0.0-M1–M5 and opennlp-tools before 2.5.12
- Built-in EMAIL and URL regex patterns contain ambiguous nested quantifiers
- Enables ReDoS and stack exhaustion on attacker-controlled input
- Fixed in opennlp-tools 2.5.12 and opennlp-core 3.0.0-M6
- CVEs
- CVE-2026-82617
- Vendors
- ApacheApache OpenNLP
- Products
- Apache OpenNLP
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82617 | ReDoS in Apache OpenNLP built-in EMAIL and URL regex name finders | 10.0 | — |
From the original article
Posted by Richard Zowalla on Sep 11 Severity: Affected versions: - Apache OpenNLP (org. apache. opennlp:opennlp-core) 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.