Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.opennlp:opennlp-tools

6 known vulnerabilities (3 critical, 1 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
2.5.12 (Sep 8, 2026): no advisory affects it
Newest unaffected release
2.5.12 (Sep 8, 2026), the latest release
Advisories
6 · 3 critical, 1 high, 1 medium
Dependents
2
Releases
47 since 1.5.1-incubating (May 6, 2011)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-82617
    Affects 2.0.0 to 2.5.11 (2.5.12 is outside it)
  • CVE-2026-63317
    Affects 1.5.1-incubating to 2.5.10 (2.5.11 is outside it); 3.0.0-M1 to 3.0.0-M3 (3.0.0-M4 is outside it)
  • CVE-2026-40682
    Affects 1.5.1-incubating to 1.9.4 (1.9.5 is outside it); 2.0.0 to 2.5.8 (2.5.9 is outside it); 3.0.0-M1 to 3.0.0-M2 (3.0.0-M3 is outside it)
  • CVE-2026-42027
    Affects 1.5.1-incubating to 1.9.4 (1.9.5 is outside it); 2.0.0 to 2.5.8 (2.5.9 is outside it); 3.0.0-M1 to 3.0.0-M2 (3.0.0-M3 is outside it)
  • CVE-2026-42440
    Affects 1.5.1-incubating to 2.5.8 (2.5.9 is outside it); 3.0.0-M1 to 3.0.0-M2 (3.0.0-M3 is outside it)
  • CVE-2017-12620
    Affects 1.5.1-incubating to 1.8.1 (1.8.2 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 6

  • CVE-2026-82617Critical 10.0

    Apache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns

    Affected: from 2.0.0, fixed in 2.5.12.

    Fixed in 2.5.12 (released Sep 8, 2026, 3 days before disclosure).

    The latest release, 2.5.12, is not affected.

  • CVE-2026-63317Medium 5.6

    Apache OpenNLP: Arbitrary Class Instantiation in GeneratorFactory via Feature Descriptor XML

    Affected: from 3.0.0-M1, fixed in 3.0.0-M4; fixed in 2.5.11.

    Fixed in 2.5.11 (released Jul 21, 2026, 3 days before disclosure) and 3.0.0-M4 (released Jun 25, 2026, 29 days before disclosure).

    The latest release, 2.5.12, is not affected.

  • CVE-2026-40682Critical 9.1

    Apache OpenNLP: XXE via Dictionary Parsing in DictionaryEntryPersistor

    Affected: from 2.0, fixed in 2.5.9; from 3.0.0-M1, fixed in 3.0.0-M3; fixed in 1.9.5; from 2.0.0, fixed in 2.5.9; from 3.0.0-M1, fixed in 3.0.0-M3; fixed in 1.9.5.

    Fixed in 1.9.5 (released Jun 18, 2026, 45 days after disclosure), 2.5.9 (released Apr 28, 2026, 6 days before disclosure) and 3.0.0-M3 (released Apr 28, 2026, 6 days before disclosure).

    The latest release, 2.5.12, is not affected.

  • CVE-2026-42027Critical 9.8

    Apache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoader

    Affected: from 2.0, fixed in 2.5.9; from 3.0.0-M1, fixed in 3.0.0-M3; fixed in 1.9.5; from 2.0.0, fixed in 2.5.9; from 3.0.0-M1, fixed in 3.0.0-M3; fixed in 1.9.5.

    Fixed in 1.9.5 (released Jun 18, 2026, 45 days after disclosure), 2.5.9 (released Apr 28, 2026, 6 days before disclosure) and 3.0.0-M3 (released Apr 28, 2026, 6 days before disclosure).

    The latest release, 2.5.12, is not affected.

  • Apache OpenNLP: OOM DoS via Unbounded Array Allocation in AbstractModelReader

    Affected: from 2.0, fixed in 2.5.9; from 3.0.0-M1, fixed in 3.0.0-M3; fixed in 1.9.5; fixed in 2.5.9; from 3.0.0-M1, fixed in 3.0.0-M3.

    Fixed in 2.5.9 (released Apr 28, 2026, 6 days before disclosure) and 3.0.0-M3 (released Apr 28, 2026, 6 days before disclosure).

    The latest release, 2.5.12, is not affected.

  • When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only…

    Affected: from 1.5.0, fixed in 1.8.2.

    Fixed in 1.8.2 (released Sep 11, 2017, 21 days before disclosure).

    The latest release, 2.5.12, is not affected.