PT-2026-36637 · Apache · Apache Opennlp

Subramanian S · Published 2026-05-02 · Updated 2026-05-04 · CVE-2026-42440

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache OpenNLP versions prior to 2.5.9 Apache OpenNLP versions prior to 3.0.0-M3

Description An OutOfMemory (OOM) Denial of Service exists in the AbstractModelReader class. The methods getOutcomes(), getOutcomePatterns(), and getPredicates() read a 32-bit signed integer count from a binary model stream and use it for array allocation without validating if the value is non-negative or within reasonable bounds. An attacker can provide a crafted .bin model file with a count field set to a very large value, such as Integer.MAX VALUE, to exhaust the available heap and trigger an OutOfMemoryError during deserialization. This allows a small malicious file to crash the Java Virtual Machine (JVM) of any process loading model files from untrusted or semi-trusted origins.

Recommendations Upgrade to version 2.5.9 for 2.x users. Upgrade to version 3.0.0-M3 for 3.x users. Treat all .bin model files as untrusted input and avoid loading models from end users or third-party repositories without integrity checks. For deployments requiring more than 10,000,000 entries, set the OPENNLP MAX ENTRIES system property to the desired positive integer at JVM startup.

Fix

DoS

Weakness Enumeration

CWE-789

Related Identifiers

CVE-2026-42440

GHSA-659W-93R5-9J6M

Affected Products

Apache Opennlp

References · 17

• https://ubuntu.com/security/CVE-2026-42440 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-42440 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42440 · Security Note
• https://lists.apache.org/thread/s8xlkx1gqbxfsq48py5h6jphjvgqp1jo · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-42440 · Security Note
• https://osv.dev/vulnerability/GHSA-659w-93r5-9j6m · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-42440 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-42440 · Vendor Advisory
• https://github.com/apache/opennlp/pull/1022 · Note
• https://github.com/apache/opennlp · Note
• https://t.me/CVEtracker/52643 · Telegram Post
• https://twitter.com/oss_security/status/2050589563614101822 · Twitter Post
• https://openwall.com/lists/oss-security/2026/05/01/21 · Note
• https://twitter.com/CVEnew/status/2051361289163755693 · Twitter Post
• https://twitter.com/infoflowcloud/status/2051362861515972807 · Twitter Post