CVE-2026-40682 - Vulnerability Analysis

Overview

Apache OpenNLP < 2.5.9 and < 3.0.0-M3 contain an XML External Entity (XXE) injection caused by unsanitized dictionary file parsing in DictionaryEntryPersistor, letting attackers trigger local file disclosure or SSRF via crafted dictionary files, exploit requires attacker to supply malicious dictionary input.

Severity & Score

Impact

Attackers can disclose local files or perform server-side request forgery via crafted dictionary files, potentially leading to sensitive data exposure or internal network access.

Mitigation

Upgrade to version 2.5.9 or 3.0.0-M3 or later.

References

• https://lists.apache.org/thread/r6jpt0qr9nj67gqhppqg7jxf8vsbo0w6
• http://www.openwall.com/lists/oss-security/2026/05/01/19

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner