Apache Software Foundation OpenNLP

Apache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns

When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only affects applications that load models or dictionaries from untrusted sources. The versions 1.5.0 to 1.5.3, 1.6.0, 1.7.0 to 1.7.2, 1.8.0 to 1.8.1 of Apache OpenNLP are affected.

Apache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoader

Apache OpenNLP: XXE via Dictionary Parsing in DictionaryEntryPersistor

Apache OpenNLP: OOM DoS via Unbounded Array Allocation in AbstractModelReader

Apache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializer

Apache OpenNLP :: Core :: ML :: LibSVM: Unsafe Java Deserialization in SvmDoccatModel

Apache OpenNLP: Arbitrary Class Instantiation in GeneratorFactory via Feature Descriptor XML