Executive brief
Apache OpenNLP, a machine learning library for processing natural language text, contains a vulnerability that allows the application to instantiate arbitrary Java classes. An attacker could exploit this by providing a specially crafted model file or a malicious format name, potentially leading to unauthorized actions like network connections or file access if dangerous classes exist on the system. Organizations should upgrade to the latest version to ensure only approved, safe components are loaded by the software.
Technical details
Apache OpenNLP before versions 2.5.10 and 3.0.0-M5 contains three code paths (GeneratorFactory, StreamFactoryRegistry, and StringInterners) that use Class.forName() to load and instantiate classes by name without validation. An attacker who can supply a crafted model archive or an untrusted format name can control the class name being instantiated. While this is not direct remote code execution, it allows an attacker to trigger side effects such as JNDI lookups, outbound network I/O, or filesystem access if a suitable 'gadget' class with a no-arg constructor or static initializer is present on the classpath. The fix introduces a package-prefix allowlist via ExtensionLoader to restrict which classes can be initialized.
Affected products
- Apache OpenNLP before 2.5.10, before 3.0.0-M5
Timeline
- 2026-07-24: advisory: CVE-2026-63317 published by Apache Software Foundation