Apache OpenNLP ExtensionLoader Vulnerability: Critical CVE Alert
- Severity
- HIGH
- Affected component
- opennlp-tools (maven)
- Patched version
- 3.0.0-M3
An early warning has been issued for a critical vulnerability in Apache OpenNLP ExtensionLoader. Users of affected versions are advised to take immediate action.
What happened
An early warning has been issued regarding a critical vulnerability in the Apache OpenNLP ExtensionLoader.instantiateExtension method. This vulnerability allows for arbitrary class instantiation via the model manifest, potentially leading to the execution of static initializers of classes on the classpath during model loading. Versions before 1.9.5, 2.5.9, and 3.0.0-M3 are reportedly affected.
The vulnerability, tracked as GHSA-CX4M-2P55-RW7J and CVE-2026-42027, was first flagged on May 4, 2026. It has not been reported as exploited in the wild. Users of opennlp-tools versions prior to the specified patched versions should assess their exposure and take appropriate action.
What to do about it
- Upgrade to version 1.9.5 for 1.x users, 2.5.9 for 2.x users, and 3.0.0-M3 for 3.x users of opennlp-tools.
- Review your project dependencies to identify any use of affected versions of opennlp-tools.
- Monitor the primary sources for updates on the vulnerability and any additional mitigation advice.
How 0Day would have caught this
opennlp-tools is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are potentially affected if you are using opennlp-tools versions before 1.9.5, 2.5.9, or 3.0.0-M3.
What should I do right now?
Immediately upgrade to version 1.9.5 for 1.x, 2.5.9 for 2.x, and 3.0.0-M3 for 3.x users of opennlp-tools.
Where can I find more information about this vulnerability?
Consult the primary sources listed in the incident data for the most up-to-date information.