CVE-2026-67211: Apache OpenNLP SymSpellModelSerializer denial of service via unbounded map pre-sizing

CVE-2026-67211 · Severity: high · CVSS 7.5 · Published 2026-09-11

Apache OpenNLP's spell-check module contains a denial of service vulnerability in how it loads spell-check model files. An attacker can craft a malicious model file that causes the application to attempt allocating gigabytes of memory, crashing the process. Since legitimate use cases may load model files from various sources, this can impact production systems processing text that relies on spell-checking.

Technologies: Apache Opennlp. Vendors: Apache.

Quick answers

Is CVE-2026-67211 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-67211 being exploited in the wild.
How severe is CVE-2026-67211?
High severity, with a CVSS score of 7.5, published 11 September 2026.
Which products and versions are affected?
Apache Opennlp 3.0.0-M4, 3.0.0-M5.
Is there a fix for CVE-2026-67211?
A patch was published on 2026-09-11: Fix available in 3.0.0-M6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-67211 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-67211?
Check whether you run Apache Opennlp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a denial of service via unbounded resource allocation in SymSpellModelSerializer.create(). The method reads two 32-bit signed integers (unigramCount and bigramCount) from a binary model stream and uses them directly to pre-size LinkedHashMap objects, with only a non-negative validation applied. An attacker can set either count field to Integer.MAX_VALUE or similar large values to force the JVM to allocate 4–8 GB of heap memory during map initialization, triggering an OutOfMemoryError. The attack requires no authentication and can be mounted with a crafted .bin file under 100 bytes. All code paths deserializing SymSpell models are affected, including command-line tools and classpath model loading. The fix applies an upper bound (default 10,000,000 entries) checked before pre-sizing, causing deserialization to fail fast with an IOException instead of allocating massive backing arrays.

Affected products

  • Apache OpenNLP 3.0.0-M4, 3.0.0-M5

Timeline

  • 2026-09-11: disclosed
  • 2026-09-11: patched: Fix available in 3.0.0-M6

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.