Advisories · Technology

Apache Software Foundation Apache OpenNLP.

Every CVE that names Apache Software Foundation Apache OpenNLP among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-82617 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Apache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns
- Apache Software Foundation Apache OpenNLP
- Denial of service
Not analysed yet 11 Sept 2026
CVE-2026-67211 CVE record

CVSS 7.5 High

Apache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializer
- Apache Software Foundation Apache OpenNLP
- Denial of service
Not analysed yet 11 Sept 2026
CVE-2026-63317 CVE record

CVSS 5.6 Medium

Apache OpenNLP: Arbitrary Class Instantiation in GeneratorFactory via Feature Descriptor XML
- Apache Software Foundation Apache OpenNLP
- Code injection
Not analysed yet 24 Jul 2026