Login Request a demo
AO
Product
Apache OpenNLP
by Apache Software Foundation · last CVE Sep 11, 2026
6
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities6In the news0Timeline
Severity mix
Critical 3High 2Medium 1Low 0
Severity
All severities6Critical3High2Medium1Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Apache OpenNLP to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-82617
9.8
1%
Sep 11
Apache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns
Affected: 3.0.0-M1 before 3.0.0-M6; 2.0.0 before 2.5.12
CVE-2026-42027
9.8
1%
May 4
Apache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoader
Affected: 2.0 before 2.5.9; 3.0.0-M1 before 3.0.0-M3; before 1.9.5
CVE-2026-40682
9.1
0%
May 4
Apache OpenNLP: XXE via Dictionary Parsing in DictionaryEntryPersistor
Affected: 2.0 before 2.5.9; 3.0.0-M1 before 3.0.0-M3; before 1.9.5
CVE-2026-67211
7.5
1%
Sep 11
Apache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializer
Affected: 3.0.0-M4 before 3.0.0-M6
CVE-2026-42440
7.5
1%
May 4
Apache OpenNLP: OOM DoS via Unbounded Array Allocation in AbstractModelReader
Affected: 2.0 before 2.5.9; 3.0.0-M1 before 3.0.0-M3; before 1.9.5
CVE-2026-63317
5.6
1%
Jul 24
Apache OpenNLP: Arbitrary Class Instantiation in GeneratorFactory via Feature Descriptor XML
Affected: 3.0.0-M1 before 3.0.0-M4; before 2.5.11
Showing 6