Skip to content
Fencer Intel
critical 9.8

CVE-2026-42027 in the critical feed json

Apache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoader

published 6mo ago modified 14d ago also EUVD-2026-27005 , GHSA-cx4m-2p55-rw7j

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 53%
public exploits
0
none known

Summary

Arbitrary Class Instantiation via Model Manifest in Apache OpenNLP ExtensionLoader

Versions Affected: before 1.9.5, before 2.5.9, before 3.0.0-M3

Description:

The ExtensionLoader.instantiateExtension(Class, String) method loads a class by its fully-qualified name via Class.forName() and invokes its no-arg constructor, with the class name sourced from the manifest.properties entry of a model archive. The existing isAssignableFrom check correctly rejects classes that are not subtypes of the expected extension interface (BaseToolFactory for factory=, ArtifactSerializer for serializer-class-*), but the check runs after Class.forName() has already loaded and initialized the named class.

Class.forName() with default initialization semantics executes the target class's static initializer before returning, so an attacker who can supply a crafted model archive can cause the static initializer of any class on the classpath to run during model loading, regardless of whether that class passes the subsequent type check.

Exploitation requires a class with attacker-useful side effects in its static initializer (for example, JNDI lookup, outbound network I/O, or filesystem access) to be present on the classpath, so this is not a drop-in remote code execution; however, the attack surface grows as third-party model distribution becomes more common (community model repositories, Hugging Face-style sharing), where users routinely load model files from origins they do not control. A secondary, narrower vector affects deployments that ship legitimate BaseToolFactory or ArtifactSerializer subclasses with side-effecting no-arg constructors: a malicious manifest can name such a class and force its constructor to run during model load.

Mitigation:

* 2.x users should upgrade to 2.5.9. * 3.x users should upgrade to 3.0.0-M3.

Note: The fix introduces a package-prefix allowlist that is consulted before Class.forName() is invoked, so the static initializer of a disallowed class is never executed. Classes under the opennlp. prefix remain permitted by default. Deployments that load models referencing factories or serializers outside opennlp.* must opt those packages in, either programmatically via ExtensionLoader.registerAllowedPackage(String) before the first model load, or by setting the OPENNLP_EXT_ALLOWED_PACKAGES system property to a comma-separated list of allowed package prefixes.

Users who cannot upgrade immediately should ensure that all model files are sourced from trusted origins and should audit their classpath for classes with side-effecting static initializers or constructors, particularly any that perform JNDI lookups, network requests, or filesystem operations during class initialization.

Patch / fix

  • maven org.apache.opennlp:opennlp-tools 1.9.5, 2.5.9, 3.0.0-M3
  • Apache Software Foundation Apache OpenNLP 1.9.5, 2.5.9, 3.0.0-M3
  • Red Hat Red Hat OpenShift AI 2.25 1788198681
  • apache-opennlp Debian 14 2.5.9-1

debian advisories DEBIAN-CVE-2026-42027

  • opennlp openSUSE Tumbleweed 1.9.5-1.1

opensuse advisories openSUSE-SU-2026:11281-1

Is CVE-2026-42027 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-42027 updated cvss 7.5

Apache OpenNLP: Apache OpenNLP: Arbitrary Class Loading via Model Manifest

  • Red Hat Fuse 7 opennlp-tools Red Hat OpenShift AI (RHOAI) rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift AI 2.25 rhoai/odh-trustyai-service-rhel9 1788198681
    fixed: vendor fix RHSA-2026:65126
  • Red Hat build of Apache Camel for Spring Boot 4 opennlp-tools
    not affected: vulnerable code not in execute path
  • Red Hat Data Grid 8 opennlp-tools
    not affected: component not present
  • Red Hat JBoss Enterprise Application Platform 8 opennlp-tools Red Hat JBoss Enterprise Application Platform Expansion Pack opennlp-tools Red Hat OpenShift AI (RHOAI) rhoai/odh-trustyai-service-rhel8 Red Hat OpenShift AI 2.25 rhoai/odh-rhel9-operator 1788331391, rhoai/odh-vllm-cpu-rhel9 1786712073, rhoai/odh-dashboard-rhel9 1788312226, rhoai/odh-modelmesh-rhel9 1788319539, rhoai/odh-operator-bundle 1788332816, rhoai/odh-vllm-cuda-rhel9 1786710989, +70 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
6mo ago

Exploit prediction

0.71% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.apache.opennlp:opennlp-tools
>=2.0.0, <2.5.9
>=3.0.0-M1, <3.0.0-M3
<1.9.5
2.5.9
3.0.0-M3
1.9.5

Affected products

  • Apache Software Foundation Apache OpenNLP
  • Red Hat Red Hat OpenShift AI 2.25
  • Red Hat Red Hat build of Apache Camel for Spring Boot 4
  • Red Hat Red Hat Data Grid 8
  • Red Hat Red Hat Fuse 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 8
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Red Hat OpenShift AI (RHOAI)

Classification

Weakness
  • CWE-470 Use of Externally-Controlled Input to Select Classes or Code
  • CWE-502 Deserialization of Untrusted Data
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.