Executive brief
Apache OpenNLP is a machine learning toolkit used for processing natural language text. A security vulnerability in its document categorization module allows an attacker to potentially execute malicious code on a server. This occurs when the system processes specially crafted data files from untrusted sources, which could lead to a full system compromise depending on other software installed on the server.
Technical details
The SvmDoccatModel.deserialize(InputStream) method in the libsvm document categorization module uses java.io.ObjectInputStream.readObject() without an ObjectInputFilter. Because ObjectInputStream materializes the entire object graph before performing a type cast, an attacker can trigger the instantiation of arbitrary classes. If a 'gadget chain' (a sequence of executable code within available libraries) exists on the application's classpath, a crafted serialized object can lead to arbitrary code execution (RCE). The vulnerability was introduced in version 3.0.0-M1 and is fixed in 3.0.0-M4.
Affected products
- Apache Software Foundation Apache OpenNLP :: Core :: ML :: LibSVM 3.x versions before 3.0.0-M4
Timeline
- 2026-07-06: advisory: CVE published by Apache Software Foundation
- 2026-07-06: disclosed