OutOfMemory Denial of Service Vulnerability in Apache OpenNLP's SymSpellModelSerializer

CVE-2026-67211

What is CVE-2026-67211?

The SymSpellModelSerializer.create() method in Apache OpenNLP has a vulnerability that allows attackers to exploit unbounded map pre-sizing, potentially leading to a denial of service. When processing a maliciously crafted .bin model file, it directly takes attacker-controlled integer values without sufficient validation, resulting in a massive memory allocation that can exhaust heap space. This can crash the Java Virtual Machine (JVM) and affects various code paths that deserialize SymSpell models. Users are advised to upgrade to version 3.0.0-M6, where an upper bound has been introduced to mitigate this risk. Immediate actions should include treating all SymSpell .bin files from untrusted sources as potentially malicious.

References