IT Security 2 months ago

Apache OpenNLP CVE‑2026‑82617: Regex‑Based Denial‑of‑Service Vulnerability

Apache OpenNLP’s built‑in email and URL regex finders can be abused to cause CPU spikes or stack overflows, leading to denial‑of‑service. Upgrade to the patched versions. Apache OpenNLP’s built‑in email and URL regex finders can be abused to cause CPU spikes or stack overflows, leading to denial‑of‑service. Upgrade to the patched versions.

FacebookXReddit

IT Security

Executive summary

Apache OpenNLP versions 2.0.0‑2.5.11 and 3.0.0‑M1‑M5 contain regex patterns that can be triggered by crafted input to cause extreme CPU consumption or stack overflow, resulting in denial‑of‑service. The issue is fixed in OpenNLP 2.5.12 and 3.0.0‑M6.

What is affected

  • Apache OpenNLP library versions 2.0.0 through 2.5.11
  • Apache OpenNLP milestone versions 3.0.0‑M1 through 3.0.0‑M5
  • The built‑in name‑finder patterns DEFAULT_REGEX_NAME_FINDER.EMAIL and DEFAULT_REGEX_NAME_FINDER.URL

Severity and evidence

The vulnerability enables a regular‑expression denial‑of‑service (ReDoS) condition. Laboratory testing shows:

  • EMAIL pattern: ~32 KB of crafted text consumes several seconds of CPU; cost grows quadratically.
  • URL pattern: ~4 KB of query‑string tokens exhausts the thread stack on default JVM settings, throwing StackOverflowError. On reduced stack sizes (e.g., -Xss512k) only ~1 KB is sufficient.

No authentication or special configuration is required.

Business or operational impact

An attacker who can supply text for analysis (e.g., via a web service, chatbot, or document‑processing pipeline) can:

  • Consume server CPU for seconds to minutes per request, degrading performance for legitimate users.
  • Crash worker threads, potentially bringing down the entire application if thread pools are exhausted.

Both outcomes constitute a denial‑of‑service risk.

Detection considerations

  • Monitor for unusually long response times or high CPU usage correlated with text‑processing endpoints.
  • Look for java.lang.StackOverflowError exceptions originating from RegexNameFinder.find calls.
  • Enable JVM‑level logging of regex matcher backtracking if available.

Recommended defensive actions

  1. Upgrade Apache OpenNLP to version 2.5.12 or 3.0.0‑M6 (or later) which contain the fix.
  2. If immediate upgrade is not possible, avoid using the default EMAIL and URL finders on untrusted input.
  3. Validate or sanitize input length before passing it to RegexNameFinder.
  4. Configure JVM stack size (-Xss) appropriately for your workload and consider limiting thread pool sizes.

Workarounds or mitigations, if supported

  • Replace the default finders with custom regex patterns that do not contain nested quantifiers.
  • Pre‑filter input to reject strings that exceed a safe length threshold (e.g., >1 KB for URL pattern).
  • Run the regex processing in a separate, resource‑limited sandbox to contain potential CPU spikes.

Patch or remediation status

  • Fixed in Apache OpenNLP 2.5.12.
  • Fixed in Apache OpenNLP 3.0.0‑M6 for the milestone line.
  • No additional vendor‑issued patches are noted beyond these version updates.

References

  • NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-82617
  • Apache OpenNLP release notes (2.5.12 and 3.0.0‑M6)

Publication date and last checked date

  • Publication date: 2026-09-16
  • Last checked: 2026-09-17

← Back to IT Security