Critical severity · published Oct 3, 2017
CVE-2017-12620
When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only affects applications that load models or…
9.8
CVSS
3%
EPSS
No
On KEV
Description
When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only affects applications that load models or dictionaries from untrusted sources. The versions 1.5.0 to 1.5.3, 1.6.0, 1.7.0 to 1.7.2, 1.8.0 to 1.8.1 of Apache OpenNLP are affected.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.0% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Opennlp · Apache
1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.6.0; 1.7.0; +4 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-12620
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-12620
Exploit
http://opennlp.apache.org/news/cve-2017-12620.html
More from Opennlp
9.8
CVE-2026-82617
Apache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns
9.8
CVE-2026-42027
Apache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoader
9.1
CVE-2026-40682
Apache OpenNLP: XXE via Dictionary Parsing in DictionaryEntryPersistor
7.5
CVE-2026-67211
Apache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializer
7.5
CVE-2026-42440
Apache OpenNLP: OOM DoS via Unbounded Array Allocation in AbstractModelReader