Description
The two built-in name-finder patterns exposed by
opennlp.tools.namefind.RegexNameFinderFactory - DEFAULT_REGEX_NAME_FINDER.EMAIL
and DEFAULT_REGEX_NAME_FINDER.URL - contain ambiguous nested quantifiers. An
application that obtains these finders through
RegexNameFinderFactory.getDefaultRegexNameFinders(...) and then applies them to
untrusted text through RegexNameFinder.find(String[]) or RegexNameFinder.find(String)
can be driven into super-linear backtracking or into unbounded matcher recursion by a
small crafted input.





For the EMAIL pattern, a long run of local-part characters that is never followed by an
@ forces the matcher to re-scan to end-of-input from every starting offset. Cost grows
quadratically with input length: an input of approximately 32 KB consumes several seconds
of CPU in a single find() call and returns no match, and each doubling of the input
multiplies the cost roughly four-fold.





For the URL pattern, the query-string sub-expression nests a capturing repetition inside
an outer repetition. The JDK matcher recurses once per query token, so an input of
approximately 4 KB containing many &-separated tokens exhausts the thread stack and
causes java.lang.StackOverflowError to propagate out of find(), terminating the
calling thread. On a thread created with a smaller stack (for example -Xss512k, typical
of server worker pools) approximately 1 KB is sufficient.





In both cases an attacker who can supply text for analysis can convert a single request
into seconds to minutes of pinned CPU, or into an abrupt thread death, denying service to
the embedding application. No authentication, special configuration, or model file is
required beyond the application having selected one of the two built-in finders.





This issue affects Apache OpenNLP: from 2.0.0 through 2.5.11; from 3.0.0-M1 through
3.0.0-M5.









Users are recommended to upgrade to version 2.5.12, or to 3.0.0-M6 for users tracking the
3.0.0 milestone line, which fix the issue.
Published: 2026-09-11
Score: 10 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Service Denial
Action: Apply Patch
AI Analysis

Impact

The vulnerability is a regular‑expression denial of service (ReDoS) and stack exhaustion flaw in Apache OpenNLP’s built‑in EMAIL and URL name‑finder patterns. The regexes contain ambiguous nested quantifiers that allow an attacker to craft input that forces super‑linear backtracking or unbounded recursion. As a result, a call to RegexNameFinder.find can consume minutes of CPU time or trigger a java.lang.StackOverflowError, leading to significant denial of service for any application that processes untrusted text through these finders.

Affected Systems

The issue impacts Apache OpenNLP versions 2.0.0 through 2.5.11 and 3.0.0‑M1 through 3.0.0‑M5. The affected component is the RegexNameFinderFactory class in the Apache OpenNLP library distributed by the Apache Software Foundation.

Risk and Exploitability

The flaw is highly severe (CVSS 10) and can be triggered without authentication or special configuration—any untrusted input provided to RegexNameFinder.find is sufficient. Because the application can immediately invoke the vulnerable finders, an attacker can convert a single request into several seconds to minutes of CPU consumption or an abrupt thread death, effectively causing a denial of service. The EPSS score is low, at < 1%, and the vulnerability can be exploited immediately with untrusted input. Attackers could deliver malicious payloads through any user‑generated content that the application feeds to the OpenNLP library.

Generated by OpenCVE AI on September 21, 2026 at 05:09 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache OpenNLP to version 2.5.12 or 3.0.0‑M6.
  • Configure the application to disable or replace the built‑in EMAIL and URL patterns with safer custom patterns that avoid nested quantifiers.
  • Implement input validation or size limits before passing user‑supplied text to the OpenNLP library.
  • Wrap RegexNameFinder calls in a separate thread with a timeout, and abort if the operation exceeds a safe execution time to mitigate resource exhaustion.

Generated by OpenCVE AI on September 21, 2026 at 05:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 16 Sep 2026 14:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:apache:opennlp:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:opennlp:3.0.0:m1:*:*:*:*:*:*
cpe:2.3:a:apache:opennlp:3.0.0:m2:*:*:*:*:*:*
cpe:2.3:a:apache:opennlp:3.0.0:m3:*:*:*:*:*:*
cpe:2.3:a:apache:opennlp:3.0.0:m4:*:*:*:*:*:*
cpe:2.3:a:apache:opennlp:3.0.0:m5:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Sun, 13 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache opennlp
Vendors & Products Apache
Apache opennlp

Fri, 11 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Description The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULT_REGEX_NAME_FINDER.EMAIL and DEFAULT_REGEX_NAME_FINDER.URL - contain ambiguous nested quantifiers. An application that obtains these finders through RegexNameFinderFactory.getDefaultRegexNameFinders(...) and then applies them to untrusted text through RegexNameFinder.find(String[]) or RegexNameFinder.find(String) can be driven into super-linear backtracking or into unbounded matcher recursion by a small crafted input. For the EMAIL pattern, a long run of local-part characters that is never followed by an @ forces the matcher to re-scan to end-of-input from every starting offset. Cost grows quadratically with input length: an input of approximately 32 KB consumes several seconds of CPU in a single find() call and returns no match, and each doubling of the input multiplies the cost roughly four-fold. For the URL pattern, the query-string sub-expression nests a capturing repetition inside an outer repetition. The JDK matcher recurses once per query token, so an input of approximately 4 KB containing many &-separated tokens exhausts the thread stack and causes java.lang.StackOverflowError to propagate out of find(), terminating the calling thread. On a thread created with a smaller stack (for example -Xss512k, typical of server worker pools) approximately 1 KB is sufficient. In both cases an attacker who can supply text for analysis can convert a single request into seconds to minutes of pinned CPU, or into an abrupt thread death, denying service to the embedding application. No authentication, special configuration, or model file is required beyond the application having selected one of the two built-in finders. This issue affects Apache OpenNLP: from 2.0.0 through 2.5.11; from 3.0.0-M1 through 3.0.0-M5. Users are recommended to upgrade to version 2.5.12, or to 3.0.0-M6 for users tracking the 3.0.0 milestone line, which fix the issue.
Title Apache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns
Weaknesses CWE-1333
References
Metrics cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Subscriptions

Apache Opennlp
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-09-11T21:07:10.400Z

Reserved: 2026-08-30T07:51:33.177Z

Link: CVE-2026-82617

cve-icon Vulnrichment

Updated: 2026-09-11T21:07:10.400Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-11T18:16:59.443

Modified: 2026-09-16T14:05:52.550

Link: CVE-2026-82617

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T05:15:09Z

Weaknesses
  • CWE-1333

    Inefficient Regular Expression Complexity