Non notée
CVE-2017-12620 When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is…
Description
When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only affects applications that load models or dictionaries from untrusted sources. The versions 1.5.0 to 1.5.3, 1.6.0, 1.7.0 to 1.7.2, 1.8.0 to 1.8.1 of Apache OpenNLP are affected.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache OpenNLP | 1.6.0 | Pas de correctif indiqué |
Références
- opennlp.apache.org opennlp.apache.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache OpenNLP
Les 7 CVE de Apache OpenNLP →
CVE-2026-82617
The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory -…
10.0
Critique
CVE-2026-67211
OOM Denial of Service via Unbounded Map Pre-Sizing in Apache OpenNLP SymSpellModelSerializer Versions Affected: -…
Non notée
CVE-2026-63317
Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP Versions Affected:…
Non notée
CVE-2026-40682
XML External Entity (XXE) via Unsanitized Dictionary Parsing in Apache OpenNLP DictionaryEntryPersistor Versions…
Non notée