Not rated
CVE-2017-12620 When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is…
Description
When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only affects applications that load models or dictionaries from untrusted sources. The versions 1.5.0 to 1.5.3, 1.6.0, 1.7.0 to 1.7.2, 1.8.0 to 1.8.1 of Apache OpenNLP are affected.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache OpenNLP | 1.6.0 | No fix stated |
References
- opennlp.apache.org opennlp.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache OpenNLP
The 7 CVEs of Apache OpenNLP →
CVE-2026-82617
The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory -…
10.0
Critical
CVE-2026-67211
OOM Denial of Service via Unbounded Map Pre-Sizing in Apache OpenNLP SymSpellModelSerializer Versions Affected: -…
Not rated
CVE-2026-63317
Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP Versions Affected:…
Not rated
CVE-2026-40682
XML External Entity (XXE) via Unsanitized Dictionary Parsing in Apache OpenNLP DictionaryEntryPersistor Versions…
Not rated