# org.apache.opennlp:opennlp-tools (Maven) vulnerabilities 6 known vulnerabilities (3 critical, 1 high, 1 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 2.5.12 (Sep 8, 2026): no advisory affects it - Newest unaffected release: 2.5.12 (Sep 8, 2026), the latest release - Dependents: 2 - Releases: 47 since 1.5.1-incubating (May 6, 2011) - Registry: https://central.sonatype.com/artifact/org.apache.opennlp/opennlp-tools - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-82617: 2.0.0 to 2.5.11 (2.5.12 is outside it) - CVE-2026-63317: 1.5.1-incubating to 2.5.10 (2.5.11 is outside it); 3.0.0-M1 to 3.0.0-M3 (3.0.0-M4 is outside it) - CVE-2026-40682: 1.5.1-incubating to 1.9.4 (1.9.5 is outside it); 2.0.0 to 2.5.8 (2.5.9 is outside it); 3.0.0-M1 to 3.0.0-M2 (3.0.0-M3 is outside it) - CVE-2026-42027: 1.5.1-incubating to 1.9.4 (1.9.5 is outside it); 2.0.0 to 2.5.8 (2.5.9 is outside it); 3.0.0-M1 to 3.0.0-M2 (3.0.0-M3 is outside it) - CVE-2026-42440: 1.5.1-incubating to 2.5.8 (2.5.9 is outside it); 3.0.0-M1 to 3.0.0-M2 (3.0.0-M3 is outside it) - CVE-2017-12620: 1.5.1-incubating to 1.8.1 (1.8.2 is outside it) ## Advisories (6) ### [CVE-2026-82617](https://cve.now/CVE-2026-82617): Apache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns - Severity: Critical 10.0 - Published: Sep 11, 2026 - Affected: from 2.0.0, fixed in 2.5.12. - Fixed in 2.5.12 (released Sep 8, 2026, 3 days before disclosure). - The latest release, 2.5.12, is not affected. ### [CVE-2026-63317](https://cve.now/CVE-2026-63317): Apache OpenNLP: Arbitrary Class Instantiation in GeneratorFactory via Feature Descriptor XML - Severity: Medium 5.6 - Published: Jul 24, 2026 - Affected: from 3.0.0-M1, fixed in 3.0.0-M4; fixed in 2.5.11. - Fixed in 2.5.11 (released Jul 21, 2026, 3 days before disclosure) and 3.0.0-M4 (released Jun 25, 2026, 29 days before disclosure). - The latest release, 2.5.12, is not affected. ### [CVE-2026-40682](https://cve.now/CVE-2026-40682): Apache OpenNLP: XXE via Dictionary Parsing in DictionaryEntryPersistor - Severity: Critical 9.1 - Published: May 4, 2026 - Affected: from 2.0, fixed in 2.5.9; from 3.0.0-M1, fixed in 3.0.0-M3; fixed in 1.9.5; from 2.0.0, fixed in 2.5.9; from 3.0.0-M1, fixed in 3.0.0-M3; fixed in 1.9.5. - Fixed in 1.9.5 (released Jun 18, 2026, 45 days after disclosure), 2.5.9 (released Apr 28, 2026, 6 days before disclosure) and 3.0.0-M3 (released Apr 28, 2026, 6 days before disclosure). - The latest release, 2.5.12, is not affected. ### [CVE-2026-42027](https://cve.now/CVE-2026-42027): Apache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoader - Severity: Critical 9.8 - Published: May 4, 2026 - Affected: from 2.0, fixed in 2.5.9; from 3.0.0-M1, fixed in 3.0.0-M3; fixed in 1.9.5; from 2.0.0, fixed in 2.5.9; from 3.0.0-M1, fixed in 3.0.0-M3; fixed in 1.9.5. - Fixed in 1.9.5 (released Jun 18, 2026, 45 days after disclosure), 2.5.9 (released Apr 28, 2026, 6 days before disclosure) and 3.0.0-M3 (released Apr 28, 2026, 6 days before disclosure). - The latest release, 2.5.12, is not affected. ### [CVE-2026-42440](https://cve.now/CVE-2026-42440): Apache OpenNLP: OOM DoS via Unbounded Array Allocation in AbstractModelReader - Severity: High 7.5 - Published: May 4, 2026 - Affected: from 2.0, fixed in 2.5.9; from 3.0.0-M1, fixed in 3.0.0-M3; fixed in 1.9.5; fixed in 2.5.9; from 3.0.0-M1, fixed in 3.0.0-M3. - Fixed in 2.5.9 (released Apr 28, 2026, 6 days before disclosure) and 3.0.0-M3 (released Apr 28, 2026, 6 days before disclosure). - The latest release, 2.5.12, is not affected. ### [CVE-2017-12620](https://cve.now/CVE-2017-12620): When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only… - Severity: Unrated - Published: Oct 2, 2017 - Affected: from 1.5.0, fixed in 1.8.2. - Fixed in 1.8.2 (released Sep 11, 2017, 21 days before disclosure). - The latest release, 2.5.12, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.apache.opennlp:opennlp-tools Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.