PT-2026-36635 · Apache · Apache Opennlp

Subramanian S · Published 2026-05-02 · Updated 2026-05-12 · CVE-2026-40682

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache OpenNLP versions prior to 2.5.9 Apache OpenNLP versions prior to 3.0.0-M3

Description The DictionaryEntryPersistor class initializes a static SAXParserFactory without enabling FEATURE SECURE PROCESSING or disabling DTD processing. When the create(InputStream, EntryInserter) function is invoked, external entity resolution and DOCTYPE declarations remain enabled. An attacker providing a crafted dictionary file containing a malicious DOCTYPE declaration can trigger local file disclosure via file:// entity references or server-side request forgery (SSRF)—a technique where the attacker forces the server to make requests to an unintended location—via http:// entity references during SAX parsing. The Dictionary(InputStream) constructor, which is the documented API for loading user-supplied dictionaries, delegates directly to this method.

Recommendations Upgrade to version 2.5.9 for 2.x users. Upgrade to version 3.0.0-M3 for 3.x users. Ensure all dictionary files are sourced from trusted origins. Implement input validation to reject any XML containing a DOCTYPE declaration before it reaches the Dictionary(InputStream) constructor.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2026-40682

GHSA-4V8G-86X5-3VRC

Affected Products

Apache Opennlp

References · 17

• https://cve.org/CVERecord?id=CVE-2026-40682 · Security Note
• https://lists.apache.org/thread/r6jpt0qr9nj67gqhppqg7jxf8vsbo0w6 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-40682 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-40682 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40682 · Security Note
• https://osv.dev/vulnerability/GHSA-4v8g-86x5-3vrc · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-40682 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-40682 · Vendor Advisory
• https://github.com/apache/opennlp/pull/1020 · Note
• https://github.com/apache/opennlp/pull/1019 · Note
• https://github.com/apache/opennlp · Note
• https://openwall.com/lists/oss-security/2026/05/01/19 · Note
• https://issues.apache.org/jira/browse/OPENNLP-1819 · Note
• https://twitter.com/oss_security/status/2050589563614101822 · Twitter Post
• http://openwall.com/lists/oss-security/2026/05/01/19 · Note