SvmDoccatModel.deserialize uses java.io.ObjectInputStream to read an InputStream without installing an ObjectInputFilter. During deserialization every class referenced in the stream is instantiated before the object is cast to SvmDoccatModel. If an attacker provides a crafted serialization stream that contains a gadget chain present on the running application’s classpath, the chain can execute during deserialization and lead to arbitrary code execution in the JVM. Apache OpenNLP itself contains no known gadget chains, but downstream applications that embed the libsvm module and have vulnerable transitive dependencies are at risk. The exposed public static method therefore allows untrusted code to be executed when a model instance is loaded from foreign sources, compromising confidentiality, integrity, and availability.

Apache Software Foundation’s Apache OpenNLP Core ML LibSVM is affected for all releases before 3.0.0-M4. The vulnerability exists in the libsvm document categorization module, which is only present on the 3.x line.

The CVSS score of 7.3 signifies high severity. The EPSS score of 9% indicates a measurable likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited observed exploitation. The likely attack vector is inferred as remote, because the method is public and static and can be invoked with an attacker‑controlled stream sent over a network or supplied from a malicious file; this inference is drawn from the description, not directly stated in the advisory. Exploitation requires that the application’s classpath contain a usable deserialization gadget chain; without such a chain the vulnerability would be confined to environments with vulnerable transitive dependencies.