Apache OpenNLP: model archive manifest names any classpath class and runs its static initializer

Impact

ExtensionLoader.instantiateExtension() calls Class.forName() on a class name taken from a model archive's manifest.properties before checking that the class is a legitimate BaseToolFactory or ArtifactSerializer. Class.forName() runs the target's static initializer first, so loading an untrusted model file executes the static initialization of any class on the classpath - JNDI lookups, outbound network calls, filesystem access, whatever a gadget class happens to do. This is the familiar untrusted-model-file problem in a Java NLP stack: teams pulling models from community repositories treat a model archive as data, and it is not. Apache is explicit that this is not drop-in RCE - it needs a side-effecting class already present - and the secondary path is narrower still, requiring a shipped factory or serializer with a side-effecting no-arg constructor. The 9.8 NVD score assumes the gadget is available; on a minimal classpath the practical impact is lower. Note that the Red Hat products in the affected list (OpenShift AI, Camel for Spring Boot, Data Grid, Fuse, JBoss EAP) are downstream consumers of the library, not separately broken.

Who can reach it

Anyone who can supply a model archive that an OpenNLP process loads - a community or Hugging Face-style model repository, a user upload path, or a shared model store. No authentication to OpenNLP itself is involved; the trust boundary is the model file.

What to do

Upgrade to OpenNLP 2.5.9 (2.x), 3.0.0-M3 (3.x), or 1.9.5 (1.x). The fix adds a package-prefix allowlist consulted before Class.forName(), with opennlp.* permitted by default - deployments that legitimately load factories or serializers from other packages must opt those in via ExtensionLoader.registerAllowedPackage() before the first model load or the OPENNLP_EXT_ALLOWED_PACKAGES system property, or model loading will start failing after the upgrade. Red Hat consumers take RHSA-2026:65126. This is a library upgrade and an application restart, no node action. If you cannot upgrade now, load models only from origins you control and audit the classpath for classes doing JNDI, network or filesystem work in static initializers or no-arg constructors.

References

Related entries

• LiteLLM proxy: SQL injection in a database query pathCVE-2026-42208 · LiteLLM proxyCritical
• PyTorch Lightning: Reintroduced unsafe deserialization in 2.6.2CVE-2026-44484 · PyTorch LightningCritical
• LiteLLM proxy: Host-header parsing flaw in the proxyCVE-2026-49468 · LiteLLM proxyCritical
• SGLang (`/v1/rerank`): RCE via a malicious `tokenizer.chat_template` rendered as Jinja2CVE-2026-5760 · SGLang (`/v1/rerank`)Critical
• SGLang (scheduler ROUTER socket): ROUTER socket binds `0.0.0.0` by default and `pickle.loads()` incoming messagesCVE-2026-7301 · SGLang (scheduler ROUTER socket)Critical
• SGLang (custom logit processor): `dill.loads` on user objects when `--enable-custom-logit-processor` is setCVE-2026-7304 · SGLang (custom logit processor)Critical