Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitylow

Apache OpenNLP discloses two denial-of-service vulnerabilities (CVE-2026-67211, CVE-2026-82617), both fixed in 3.0.0-M6

1 source · 2 articlesFirst reported Updated ()2
What's new

First merged summary of this story: initial publication combining the two oss-security disclosures (posted 2026-09-11 at 19:22:24Z and 19:24:07Z) covering CVE-2026-67211 and CVE-2026-82617, including affected versions and fixed releases.

Merged summary · glm-5.3 · rewritten as coverage arrivesSummaries by Vani AI

Two Apache OpenNLP DoS flaws disclosed via oss-security on 2026-09-11: CVE-2026-67211 (out-of-memory via unbounded map pre-sizing in SymSpellModelSerializer, affecting opennlp-symspell 3.0.0-M4/M5) and CVE-2026-82617 (ReDoS/stack exhaustion via built-in EMAIL…

On 2026-09-11, two oss-security postings disclosed separate denial-of-service vulnerabilities in Apache OpenNLP. CVE-2026-67211 affects only the opennlp-symspell artifact in versions 3.0.0-M4 and 3.0.0-M5: the SymSpellModelSerializer.create() method performs unbounded map pre-sizing, allowing crafted input to trigger out-of-memory denial of service. Releases 1.x and 2.x are unaffected because the spellcheck extension was introduced in 3.0.0-M4; the issue is resolved in 3.0.0-M6. CVE-2026-82617 affects opennlp-core 3.0.0-M1 before 3.0.0-M6 and opennlp-tools 2.0.0 before 2.5.12: the DEFAULT_REGEX_NAME_FINDER.EMAIL and DEFAULT_REGEX_NAME_FINDER.URL patterns in RegexNameFinderFactory contain ambiguous nested quantifiers, so applications using these built-in finders on attacker-controlled input can be forced into regular expression denial of service or stack exhaustion. Fixes shipped in opennlp-tools 2.5.12 and opennlp-core 3.0.0-M6. Both vulnerabilities share the 3.0.0-M6 release as the fix point for the 3.x line.

Key facts
  • CVE-2026-67211: out-of-memory DoS via unbounded map pre-sizing in SymSpellModelSerializer.create()
  • CVE-2026-67211 affects opennlp-symspell 3.0.0-M4 and 3.0.0-M5 only; 1.x and 2.x unaffected because the spellcheck extension was introduced in 3.0.0-M4
  • CVE-2026-67211 fixed in opennlp-symspell 3.0.0-M6
  • CVE-2026-82617: ReDoS and stack exhaustion via ambiguous nested quantifiers in the built-in DEFAULT_REGEX_NAME_FINDER.EMAIL and DEFAULT_REGEX_NAME_FINDER.URL patterns in RegexNameFinderFactory
  • CVE-2026-82617 affects opennlp-core 3.0.0-M1 before 3.0.0-M6 and opennlp-tools 2.0.0 before 2.5.12
  • CVE-2026-82617 exploitable when built-in regex finders process attacker-controlled input
  • CVE-2026-82617 fixed in opennlp-tools 2.5.12 and opennlp-core 3.0.0-M6
  • Both flaws fixed for the 3.x line in release 3.0.0-M6
Analyze CVE-2026-67211 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-82617CVE-2026-67211
Vendors
ApacheApache OpenNLP
Products
Apache OpenNLP
Organizations
Apache Software Foundation

Coverage

oldest first · one row per article · UTC
  1. · Sep 11, 2026 oss-securityFirst report

    CVE-2026-67211: Apache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializer

    Apache OpenNLP CVE-2026-67211: unbounded map pre-sizing in SymSpellModelSerializer enables out-of-memory denial of service in opennlp-symspell 3.0.0-M4/M5.

  2. · Sep 11, 2026 oss-security

    CVE-2026-82617: Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns

    Apache OpenNLP CVE-2026-82617: built-in EMAIL and URL regex name-finder patterns enable regular expression denial-of-service and stack exhaustion in affected releases.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-82617
+1 related CVE
CVE-2026-67211
ReDoS in Apache OpenNLP built-in EMAIL and URL regex name finders
10.0
group max
—