Arbitrary Class Instantiation Vulnerability in Apache OpenNLP by Apache

CVE-2026-63317

What is CVE-2026-63317?

Apache OpenNLP contains a vulnerability that allows for arbitrary class instantiation via XML feature generator descriptors and format names. This issue arises from three code paths that load a class by its fully-qualified name without proper validation, which can be exploited if an attacker supplies a maliciously crafted model archive. The affected functionalities include reading generator elements from model archives and interpreting untrusted format names as class names. The potential for exploitation increases when harmful classes with side effects are present in the classpath. To mitigate this risk, users are advised to upgrade to the latest fixed release or ensure that all model files and format names are trusted.

References