OP
Product
Opennlp
8
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 3Medium 1Low 0
Watch
Add Opennlp to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-82617 | 9.8 | Sep 11 | Apache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns Affected: 2.0.0 before 2.5.12; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0 |
| CVE-2026-42027 | 9.8 | May 4 | Apache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoader Affected: before 2.5.9; 3.0.0; 3.0.0 |
| CVE-2017-12620 | 9.8 | Oct 3 | When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only affects applications that load models or… Affected: 1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.6.0; 1.7.0; +4 more |
| CVE-2026-40682 | 9.1 | May 4 | Apache OpenNLP: XXE via Dictionary Parsing in DictionaryEntryPersistor Affected: before 2.5.9; 3.0.0; 3.0.0 |
| CVE-2026-67211 | 7.5 | Sep 11 | Apache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializer Affected: 3.0.0; 3.0.0 |
| CVE-2026-42440 | 7.5 | May 4 | Apache OpenNLP: OOM DoS via Unbounded Array Allocation in AbstractModelReader Affected: before 2.5.9; 3.0.0; 3.0.0 |
| CVE-2026-43825 | 7.3 | Jul 6 | Apache OpenNLP :: Core :: ML :: LibSVM: Unsafe Java Deserialization in SvmDoccatModel Affected: 3.0.0; 3.0.0; 3.0.0 |
| CVE-2026-63317 | 5.6 | Jul 24 | Apache OpenNLP: Arbitrary Class Instantiation in GeneratorFactory via Feature Descriptor XML Affected: before 2.5.11; 3.0.0; 3.0.0; 3.0.0 |
Showing 8