Denial of Service Due to Unbounded Array Allocation in Apache OpenNLP

CVE-2026-42440

What is CVE-2026-42440?

The vulnerability exists within the AbstractModelReader methods in Apache OpenNLP, where attacker-controlled values can lead to unbounded array allocations during model file deserialization. This allows an attacker to craft a .bin model file that, when loaded, can trigger an OutOfMemoryError, resulting in service disruption. This issue affects any code path that deserializes .bin models, making it critical for users to upgrade to the latest versions for mitigation.

References