Apache OpenNLP: Use of Externally-Controlled Input to Select Classes or Code
CVE-2026-42027 is a high-severity use of externally-controlled input to select classes or code vulnerability in Apache OpenNLP from Apache, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, but only if a user takes part, for example by opening a link or file. The record lists versions 2.5.9, 3.0.0-M3, 1.9.5 as the first without the flaw, so updating Apache OpenNLP to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.71% chance of exploitation within 30 days, higher than 54% of scored CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Apache OpenNLP to 2.5.9 or 3.0.0-M3 or 1.9.5, whichever matches your release line, or a later version.
- Update Opennlp to 2.5.9 or a later version.
- Read the advisory on lists.apache.org for workarounds and exact fixed builds.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
- Because the attack needs a user to take part, warn users about unexpected links and files related to this product until it is patched.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Apache | Apache OpenNLP | 2.0 up to, but not including, 2.5.9; 3.0.0-M1 up to, but not including, 3.0.0-M3; before 1.9.5 | 2.5.9, 3.0.0-M3, 1.9.5 |
| Red Hat | Red Hat OpenShift AI 2.25 | Not specified in the record | Not stated |
| Red Hat | Red Hat build of Apache Camel for Spring Boot 4 | Not specified in the record | Not stated |
| Red Hat | Red Hat Data Grid 8 | Not specified in the record | Not stated |
| Red Hat | Red Hat Fuse 7 | Not specified in the record | Not stated |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | Not specified in the record | Not stated |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | Not specified in the record | Not stated |
| Red Hat | Red Hat OpenShift AI (RHOAI) | Not specified in the record | Not stated |
| Apache | Opennlp | before 2.5.9; 3.0.0 | 2.5.9 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- HighSuccess depends on conditions outside the attacker's control.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- RequiredA user must take an action such as opening a file or link.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. Scored by CNA.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 9.8 | Critical | CISA (ADP) |
| CVSS 3.1 | 7.5 | High | CNA |
Official description
Arbitrary Class Instantiation via Model Manifest in Apache OpenNLP ExtensionLoader Versions Affected: before 1.9.5, before 2.5.9, before 3.0.0-M3 Description: The ExtensionLoader.instantiateExtension(Class, String) method loads a class by its fully-qualified name via Class.forName() and invokes its no-arg constructor, with the class name sourced from the manifest.properties entry of a model archive. The existing isAssignableFrom check correctly rejects classes that are not subtypes of the expected extension interface (BaseToolFactory for factory=, ArtifactSerializer for serializer-class-*), but the check runs after Class.forName() has already loaded and initialized the named class. Class.forName() with default initialization semantics executes the target class's static initializer before returning, so an attacker who can supply a crafted model archive can cause the static initializer of any class on the classpath to run during model loading, regardless of whether that class passes the subsequent type check. Exploitation requires a class with attacker-useful side effects in its static initializer (for example, JNDI lookup, outbound network I/O, or filesystem access) to be present on the classpath, so this is not a drop-in remote code execution; however, the attack surface grows as third-party model distribution becomes more common (community model repositories, Hugging Face-style sharing), where users routinely load model files from origins they do not control. A secondary, narrower vector affects deployments that ship legitimate BaseToolFactory or ArtifactSerializer subclasses with side-effecting no-arg constructors: a malicious manifest can name such a class and force its constructor to run during model load. Mitigation: * 2.x users should upgrade to 2.5.9. * 3.x users should upgrade to 3.0.0-M3. Note: The fix introduces a package-prefix allowlist that is consulted before Class.forName() is invoked, so the static initializer of a disallowed class is never executed. Classes under the opennlp. prefix remain permitted by default. Deployments that load models referencing factories or serializers outside opennlp.* must opt those packages in, either programmatically via ExtensionLoader.registerAllowedPackage(String) before the first model load, or by setting the OPENNLP_EXT_ALLOWED_PACKAGES system property to a comma-separated list of allowed package prefixes. Users who cannot upgrade immediately should ensure that all model files are sourced from trusted origins and should audit their classpath for classes with side-effecting static initializers or constructors, particularly any that perform JNDI lookups, network requests, or filesystem operations during class initialization.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use of Externally-Controlled Input to Select Classes or Code
The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.
How developers prevent this class of flaw
- Refactor your code to avoid using reflection.
- Do not use user-controlled inputs to select and load classes or code.
- Apply strict input validation by using allowlists or indirect selection to ensure that the user is only selecting allowable classes or code.
More Use of Externally-Controlled Input to Select Classes or Code vulnerabilities (CWE-470)
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Advisories
Third-party and government advisories
- openwall.com/lists/oss-security/2026/05/01/20Mailing List, Third Party Advisory
Other references
Other vulnerabilities in Apache OpenNLP
- 9.8 Critical severity
- 7.5 High severity
- 7.5 High severity
- 7.5 High severity
Recent Use of Externally-Controlled Input to Select Classes or Code vulnerabilities
- 8.1 High severity
- 7.2 High severity
- 7.2 High severity
- 7.2 High severity
- 7.2 High severity
- 7.2 High severity
Spotted an error? Tell us.