Apache OpenNLP ExtensionLoader Vulnerability: Critical CVE Alert
- Severity
- HIGH
- Affected component
- opennlp-tools (maven)
- Patched version
- 1.9.5 || 2.5.9 || 3.0.0-M3
An early warning has been issued for a critical vulnerability in Apache OpenNLP ExtensionLoader. Users of affected versions should assess their exposure immediately.
What happened
An early warning has been issued regarding a vulnerability in the Apache OpenNLP ExtensionLoader.instantiateExtension method. This vulnerability, tracked as GHSA-CX4M-2P55-RW7J, allows for arbitrary class instantiation via model manifest, potentially leading to the execution of static initializers of classes on the classpath during model loading. Versions before 1.9.5, 2.5.9, and 3.0.0-M3 are reportedly affected.
The vulnerability was first flagged on May 4, 2026. It is classified as a critical CVE and has not yet been exploited in the wild. The affected component is opennlp-tools (maven) with reported affected versions being <1.9.5, <2.5.9, and <3.0.0-M3. The patched versions are 1.9.5 for 1.x, 2.5.9 for 2.x, and 3.0.0-M3 for 3.x.
What to do about it
- Upgrade to the latest version: 1.9.5 for 1.x, 2.5.9 for 2.x, and 3.0.0-M3 for 3.x.
- Review your project dependencies to identify any use of affected versions of opennlp-tools.
- If you are using an affected version, plan and execute an upgrade to the corresponding patched version as soon as possible.
- Monitor the primary sources for any updates or additional information regarding this vulnerability.
How 0Day would have caught this
opennlp-tools is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are potentially affected if you are using opennlp-tools (maven) versions <1.9.5, <2.5.9, or <3.0.0-M3.
What should I do right now?
Immediately review your project dependencies and upgrade to the latest version: 1.9.5 for 1.x, 2.5.9 for 2.x, and 3.0.0-M3 for 3.x.
Is this vulnerability currently being exploited?
No, this vulnerability has not yet been exploited in the wild according to the current information.
Where can I find more information?
Consult the primary source at https://github.com/advisories/GHSA-cx4m-2p55-rw7j for the latest details and updates.