As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-82617: Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns
CVE-2026-82617 affects Apache OpenNLP versions 3.0.0-M1 before 3.0.0-M6 and 2.0.0 before 2.5.12, where built-in regular expression patterns in RegexNameFinderFactory for EMAIL and URL matching contain ambiguous nested quantifiers. These patterns are susceptible to regular expression denial of service (ReDoS) and stack exhaustion attacks when processing specially crafted input.
Why it matters: Practitioners using OpenNLP for name-finding tasks must upgrade to patched versions (3.0.0-M6 or later, or 2.5.12 or later) to prevent attackers from causing denial of service through malformed email or URL strings.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-82617: Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns
CVE-2026-82617 affects Apache OpenNLP's RegexNameFinderFactory, which contains regular expressions with ambiguous nested quantifiers in the built-in EMAIL and URL patterns. These patterns are vulnerable to regular expression denial of service (ReDoS) and stack exhaustion attacks when processing crafted input. The vulnerability impacts OpenNLP 3.0.0-M1 before 3.0.0-M6 and version 2.0.0 before 2.5.12.
Why it matters: Organizations using Apache OpenNLP for named entity recognition with EMAIL or URL patterns should upgrade immediately, as a single malicious input can cause denial of service or application crash with a CVSS 10.0 severity score.
- Source published
- First seen by Cybersecurity Tracker