Vulnerabilities

TI-2026-56958 CVE-2026-82617 · GHSA-f3wj-w3qw-rw57

Apache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns

MEDIUM 50

The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULT_REGEX_NAME_FINDER.EMAIL and DEFAULT_REGEX_NAME_FINDER.URL - contain ambiguous nested quantifiers.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00767 Published 2026-09-11 Fixed in 3.0.0-M6, 2.5.12 CWE-1333

TI-2026-47528 CVE-2026-67211 · GHSA-gr8h-7qg5-vh27

Apache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializer

MEDIUM 40

OOM Denial of Service via Unbounded Map Pre-Sizing in Apache OpenNLP SymSpellModelSerializer Versions Affected: - 3.0.0-M4 - 3.0.0-M5 (The opennlp-spellcheck extension was introduced in 3.0.0-M4.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0074 Published 2026-09-11 Fixed in 3.0.0-M6 CWE-789

Vulnerabilities

Filters

Apache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns

Apache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializer