CVE-2026-42027 - Vulnerability Analysis

Overview

Apache OpenNLP before 2.5.9 and 3.0.0-M3 contains an arbitrary class instantiation vulnerability caused by loading classes via Class.forName() before type checks in ExtensionLoader.instantiateExtension, letting attackers trigger static initializers of arbitrary classes during model loading, exploit requires attacker-supplied crafted model archives.

Severity & Score

Impact

Attackers can execute static initializers of arbitrary classes, potentially causing side effects like network requests or filesystem access during model loading.

Mitigation

Upgrade to Apache OpenNLP 2.5.9 or 3.0.0-M3 or later versions.

References

• https://lists.apache.org/thread/ltlo4powjfc0w2w2yyl1o5tc7q1gcb2y
• http://www.openwall.com/lists/oss-security/2026/05/01/20

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner