https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 10:11:19 +0000 https://vulnerability.circl.lu/vuln/cve-2026-63317 <p><strong>Affected:</strong> Apache Software Foundation Apache OpenNLP</p> <p>Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP</p> <p>Versions Affected:</p> <p>- before 2.5.10 - before 3.0.0-M5</p> <p>Description:</p> <p>Three code paths in Apache OpenNLP load a class by its fully-qualified name via Class.forName() and invoke its no-arg constructor without any prior validation of the class name or its type.</p> <p>The affected paths are:</p> <p>(1) GeneratorFactory, which reads the class attribute of generator elements in an XML feature generator descriptor; such descriptors are embedded as artifacts in model archives (e.g. TokenNameFinder and POSTagger models) and are parsed during model loading, so an attacker who can supply a crafted model archive controls the class name directly.</p> <p>(2) StreamFactoryRegistry.getFactory(Class, String), which falls back to interpreting an unregistered format name as the fully-qualified class name of an ObjectStreamFactory; this is exploitable in applications that pass untrusted format names (e.g. exposing the -format parameter of the command-line tooling to external input).</p> <p>(3) StringInterners, which instantiates the interner implementation named by the opennlp.interner.class system property; this value is normally deployer-controlled, so it is hardened as defense in depth rather than being independently attacker-reachable.</p> <p>Exploitation requires a class with attacker-useful side effects in its static initializer or no-arg constructor (JNDI lookup, outbound network I/O, filesystem access) to be…</p> <p><strong>Affected:</strong> Apache Software Foundation Apache OpenNLP</p> <p>Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP</p> <p>Versions Affected:</p> <p>- before 2.5.10 - before 3.0.0-M5</p> <p>Description:</p> <p>Three code paths in Apache OpenNLP load a class by its fully-qualified name via Class.forName() and invoke its no-arg constructor without any prior validation of the class name or its type.</p> <p>The affected paths are:</p> <p>(1) GeneratorFactory, which reads the class attribute of generator elements in an XML feature generator descriptor; such descriptors are embedded as artifacts in model archives (e.g. TokenNameFinder and POSTagger models) and are parsed during model loading, so an attacker who can supply a crafted model archive controls the class name directly.</p> <p>(2) StreamFactoryRegistry.getFactory(Class, String), which falls back to interpreting an unregistered format name as the fully-qualified class name of an ObjectStreamFactory; this is exploitable in applications that pass untrusted format names (e.g. exposing the -format parameter of the command-line tooling to external input).</p> <p>(3) StringInterners, which instantiates the interner implementation named by the opennlp.interner.class system property; this value is normally deployer-controlled, so it is hardened as defense in depth rather than being independently attacker-reachable.</p> <p>Exploitation requires a class with attacker-useful side effects in its static initializer or no-arg constructor (JNDI lookup, outbound network I/O, filesystem access) to be…</p> https://vulnerability.circl.lu/vuln/cve-2026-63317