Regex Name Finder Vulnerability in Apache OpenNLP

CVE-2026-82617

What is CVE-2026-82617?

The Regex Name Finder patterns in Apache OpenNLP expose two serious vulnerabilities related to the EMAIL and URL patterns. The EMAIL pattern suffers from ambiguous nested quantifiers, causing catastrophic backtracking that leads to resource exhaustion. For instance, a specially crafted input of around 32 KB may cause the CPU to be pinned for several seconds without yielding any matches, while doubling the input length can quadratically worsen the performance impact. Similarly, the URL pattern incorporates a recursive capturing repetition that could trigger a StackOverflowError when processing large inputs. By leveraging these vulnerabilities, an attacker could trigger prolonged denial-of-service conditions with minimal effort, allowing them to disrupt the functionality of applications utilizing these vulnerable patterns. Users are advised to update to the latest versions to mitigate these risks.

References