XML external entity injection in Apache OpenNLP
Priority MEDIUM 48CWE-611Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.
Summary
When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only affects applications that load models or dictionaries from untrusted sources. The versions 1.5.0 to 1.5.3, 1.6.0, 1.7.0 to 1.7.2, 1.8.0 to 1.8.1 of Apache OpenNLP are affected.
Why it matters now
EPSS 0.03041 87th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed org.apache.opennlp:opennlp-tools (Maven): 1.8.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache OpenNLP | 1.5.0 to 1.5.3; 1.6.0; 1.7.0 to 1.7.2; 1.8.0 to 1.8.1 | — | No fix listed | CNA |
| — | org.apache.opennlp:opennlp-tools (Maven) | 1.5.0 to before 1.8.2 | 1.8.2 | Patch available | GHSA-h22x-hm8g-rxpg |
- Apache OpenNLP VendorApache Affected 1.5.0 to 1.5.3; 1.6.0; 1.7.0 to 1.7.2; 1.8.0 to 1.8.1 Fixed in — No fix listed CNA
- org.apache.opennlp:opennlp-tools (Maven) Vendor— Affected 1.5.0 to before 1.8.2 Fixed in 1.8.2 Patch available GHSA-h22x-hm8g-rxpg
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:opennlp:1.5.0:*:*:*:*:*:*:* | 1.5.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:opennlp:1.5.1:*:*:*:*:*:*:* | 1.5.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:opennlp:1.5.2:*:*:*:*:*:*:* | 1.5.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:opennlp:1.5.3:*:*:*:*:*:*:* | 1.5.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:opennlp:1.6.0:*:*:*:*:*:*:* | 1.6.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:opennlp:1.7.0:*:*:*:*:*:*:* | 1.7.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:opennlp:1.7.1:*:*:*:*:*:*:* | 1.7.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:opennlp:1.7.2:*:*:*:*:*:*:* | 1.7.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:opennlp:1.8.0:*:*:*:*:*:*:* | 1.8.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:opennlp:1.8.1:*:*:*:*:*:*:* | 1.8.1 | Vulnerable | Apache |
- cpe:2.3:a:apache:opennlp:1.5.0:*:*:*:*:*:*:* Versions 1.5.0 Vulnerable ·Apache
- cpe:2.3:a:apache:opennlp:1.5.1:*:*:*:*:*:*:* Versions 1.5.1 Vulnerable ·Apache
- cpe:2.3:a:apache:opennlp:1.5.2:*:*:*:*:*:*:* Versions 1.5.2 Vulnerable ·Apache
- cpe:2.3:a:apache:opennlp:1.5.3:*:*:*:*:*:*:* Versions 1.5.3 Vulnerable ·Apache
- cpe:2.3:a:apache:opennlp:1.6.0:*:*:*:*:*:*:* Versions 1.6.0 Vulnerable ·Apache
- cpe:2.3:a:apache:opennlp:1.7.0:*:*:*:*:*:*:* Versions 1.7.0 Vulnerable ·Apache
- cpe:2.3:a:apache:opennlp:1.7.1:*:*:*:*:*:*:* Versions 1.7.1 Vulnerable ·Apache
- cpe:2.3:a:apache:opennlp:1.7.2:*:*:*:*:*:*:* Versions 1.7.2 Vulnerable ·Apache
- cpe:2.3:a:apache:opennlp:1.8.0:*:*:*:*:*:*:* Versions 1.8.0 Vulnerable ·Apache
- cpe:2.3:a:apache:opennlp:1.8.1:*:*:*:*:*:*:* Versions 1.8.1 Vulnerable ·Apache
Remediation
- Fix · GHSA-h22x-hm8g-rxpg org.apache.opennlp:opennlp-tools (Maven) Fixed in 1.8.2 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2017-12620
- 2026-10-03 Alias added: GHSA-h22x-hm8g-rxpg
References
More Apache Opennlp vulnerabilities
- TI-2026-31914 Apache OpenNLP :: Core :: ML :: LibSVM: Unsafe Java Deserialization in SvmDoccatModel CVSS 3.1HIGH 7.3
- TI-2026-56958 Apache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns CVSS 4.0CRITICAL 10.0
- TI-2026-30407 Apache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoader CVSS 3.1CRITICAL 9.8
- TI-2026-29367 Apache OpenNLP: XXE via Dictionary Parsing in DictionaryEntryPersistor CVSS 3.1CRITICAL 9.1
- TI-2026-47528 Apache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializer CVSS 3.1HIGH 7.5
- TI-2026-30730 Apache OpenNLP: OOM DoS via Unbounded Array Allocation in AbstractModelReader CVSS 3.1HIGH 7.5
Sources
- CVE-2017-12620 · CVE Program
- CVE-2017-12620 · NVD
- FIRST EPSS
- GHSA-h22x-hm8g-rxpg · GitHub Advisory Database · CC BY 4.0
- CVE-2017-12620 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences