CVE-2026-40682
published 2026-05-04CVE-2026-40682: XML External Entity (XXE) via Unsanitized Dictionary Parsing in Apache OpenNLP DictionaryEntryPersistor Versions Affected: before 2.5.9, before 3.0.0-M3…
PriorityP261critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
0.52%
40.4th percentile
XML External Entity (XXE) via Unsanitized Dictionary Parsing in Apache OpenNLP DictionaryEntryPersistor
Versions Affected: before 2.5.9, before 3.0.0-M3
Description: The DictionaryEntryPersistor class initializes a static SAXParserFactory at class-load time without enabling FEATURE_SECURE_PROCESSING or disabling DTD processing. When create(InputStream, EntryInserter) is invoked, the only feature set on the XMLReader is namespace support — external entity resolution and DOCTYPE declarations remain fully enabled. An attacker who can supply a crafted dictionary file (e.g., a stop-word list or domain dictionary) containing a malicious DOCTYPE declaration can trigger local file disclosure via file:// entity references or server-side request forgery via http:// entity references during SAX parsing, before the application processes a single dictionary entry. This is inconsistent with the project's own XmlUtil.createSaxParser() helper, which correctly sets FEATURE_SECURE_PROCESSING and disallow-doctype-decl and is used by all other XML parsing paths in the codebase. The public Dictionary(InputStream) constructor delegates directly to this method and is the documented API for loading user-supplied dictionaries, making untrusted input a realistic scenario.
Mitigation: 2.x users should upgrade to 2.5.9. 3.x users should upgrade to 3.0.0-M3. Users who cannot upgrade immediately should ensure that all dictionary files are sourced from trusted origins and should consider wrapping the Dictionary(InputStream) constructor with input validation that rejects any XML containing a DOCTYPE declaration before it reaches the parser.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | opennlp | < 2.5.9 | 2.5.9 |
| apache | opennlp | — | — |
| apache | opennlp | — | — |
| apache_software_foundation | apache_opennlp | < 1.9.5 | 1.9.5 |
| apache_software_foundation | apache_opennlp | >= 2.0 < 2.5.9 | 2.5.9 |
| apache_software_foundation | apache_opennlp | >= 3.0.0-M1 < 3.0.0-M3 | 3.0.0-M3 |
| rhoai | odh-trustyai-service-rhel8 | — | — |
| rhoai | odh-trustyai-service-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-trustyai-cpu-py312-rhel9 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect XXE exploitation attempts via file:// entity references in XML dictionary files supplied to Apache OpenNLP DictionaryEntryPersistor ↗
- →Detect XXE exploitation attempts via http:// entity references (SSRF) in XML dictionary files supplied to Apache OpenNLP DictionaryEntryPersistor ↗
- →Flag any XML input stream containing a DOCTYPE declaration passed to the Dictionary(InputStream) constructor or DictionaryEntryPersistor.create(InputStream, EntryInserter) — the presence of DOCTYPE in dictionary XML is the attack vector ↗
- →Monitor for outbound HTTP requests originating from the JVM process hosting Apache OpenNLP (opennlp-tools) during dictionary parsing operations, which may indicate SSRF via XXE ↗
- →Identify vulnerable Apache OpenNLP deployments: opennlp-tools versions before 2.5.9 (2.x branch) or before 3.0.0-M3 (3.x branch) are affected; flag these in SCA/dependency scanning ↗
- ·The vulnerable code path is DictionaryEntryPersistor — it initializes a static SAXParserFactory at class-load time without FEATURE_SECURE_PROCESSING or DTD disabling; the only feature set on the XMLReader is namespace support, leaving external entity resolution and DOCTYPE declarations fully enabled ↗
- ·The vulnerability is inconsistent with the project's own safe helper: XmlUtil.createSaxParser() correctly sets FEATURE_SECURE_PROCESSING and disallow-doctype-decl and is used by all other XML parsing paths — only DictionaryEntryPersistor is affected ↗
- ·The public Dictionary(InputStream) constructor is the documented API for loading user-supplied dictionaries and delegates directly to the vulnerable DictionaryEntryPersistor.create() method, making untrusted input a realistic exploitation scenario ↗
- ·Multiple Red Hat products are under investigation for impact, including opennlp-tools in Red Hat Data Grid 8, Red Hat Fuse 7, Red Hat JBoss EAP Expansion Pack, and RHOAI container images (odh-trustyai-service-rhel8/rhel9, odh-workbench-jupyter-trustyai-cpu-py312-rhel9) ↗
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vendor_redhat9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
org.apache.opennlp/opennlp-tools: Apache OpenNLP: XML External Entity (XXE) vulnerability via crafted dictionary parsing
vendor_redhat·2026-05-04·CVSS 9.1
CVE-2026-40682 [CRITICAL] CWE-611 org.apache.opennlp/opennlp-tools: Apache OpenNLP: XML External Entity (XXE) vulnerability via crafted dictionary parsing
org.apache.opennlp/opennlp-tools: Apache OpenNLP: XML External Entity (XXE) vulnerability via crafted dictionary parsing
A flaw was found in Apache OpenNLP. A remote attacker can exploit this vulnerability by providing a specially crafted dictionary file. This can lead to an XML External Entity (XXE) injection, which allows for the disclosure of local files or enables server-side request forgery (SSRF), where the server makes unauthorized requests to other systems.
Package: opennlp-tools (Red Hat Data Grid 8) - Under investigation
Package: opennlp-maxent (Red Hat Fuse 7) - Under investigation
Package: opennlp-tools (Red Hat Fuse 7) - Under investigation
Package: opennlp-tools (Red Hat JBoss Enterprise Application Platform Expansion Pack) - Under investigation
Package: rhoai/odh-trust
GHSA
Apache OpenNLP DictionaryEntryPersistor Vulnerable to XML External Entity (XXE) via Unsanitized Dictionary Parsing
ghsa·2026-05-04
CVE-2026-40682 [CRITICAL] CWE-611 Apache OpenNLP DictionaryEntryPersistor Vulnerable to XML External Entity (XXE) via Unsanitized Dictionary Parsing
Apache OpenNLP DictionaryEntryPersistor Vulnerable to XML External Entity (XXE) via Unsanitized Dictionary Parsing
XML External Entity (XXE) via Unsanitized Dictionary Parsing in Apache OpenNLP DictionaryEntryPersistor
Versions Affected: before 2.5.9, before 3.0.0-M3
Description: The DictionaryEntryPersistor class initializes a static SAXParserFactory at class-load time without enabling FEATURE_SECURE_PROCESSING or disabling DTD processing. When create(InputStream, EntryInserter) is invoked, the only feature set on the XMLReader is namespace support — external entity resolution and DOCTYPE declarations remain fully enabled. An attacker who can supply a crafted dictionary file (e.g., a stop-word list or domain dictionary) containing a malicious DOCTYPE declaration can trigger local fil
GHSA
GHSA-4v8g-86x5-3vrc: XML External Entity (XXE) via Unsanitized Dictionary Parsing in Apache OpenNLP DictionaryEntryPersistor
Versions Affected: before 2
ghsa_unreviewed·2026-05-04
CVE-2026-40682 [CRITICAL] CWE-611 GHSA-4v8g-86x5-3vrc: XML External Entity (XXE) via Unsanitized Dictionary Parsing in Apache OpenNLP DictionaryEntryPersistor
Versions Affected: before 2
XML External Entity (XXE) via Unsanitized Dictionary Parsing in Apache OpenNLP DictionaryEntryPersistor
Versions Affected: before 2.5.9, before 3.0.0-M3
Description: The DictionaryEntryPersistor class initializes a static SAXParserFactory at class-load time without enabling FEATURE_SECURE_PROCESSING or disabling DTD processing. When create(InputStream, EntryInserter) is invoked, the only feature set on the XMLReader is namespace support — external entity resolution and DOCTYPE declarations remain fully enabled. An attacker who can supply a crafted dictionary file (e.g., a stop-word list or domain dictionary) containing a malicious DOCTYPE declaration can trigger local file disclosure via file:// entity references or server-side request forgery via http:// entity references during SAX p
VulDB
Apache OpenNLP up to 2.5.8/3.0.0-M2 Dictionary Parser DictionaryEntryPersistor xml external entity reference
vuldb·2026-05-01
CVE-2026-40682 [CRITICAL] Apache OpenNLP up to 2.5.8/3.0.0-M2 Dictionary Parser DictionaryEntryPersistor xml external entity reference
A vulnerability was found in Apache OpenNLP up to 2.5.8/3.0.0-M2 and classified as problematic. The affected element is the function DictionaryEntryPersistor of the component Dictionary Parser. Executing a manipulation can lead to xml external entity reference.
The identification of this vulnerability is CVE-2026-40682. The attack may be launched remotely. There is no exploit available.
It is suggested to upgrade the affected component.
No detection rules found.
No public exploits indexed.
https://lists.apache.org/thread/r6jpt0qr9nj67gqhppqg7jxf8vsbo0w6http://www.openwall.com/lists/oss-security/2026/05/01/19https://access.redhat.com/security/cve/CVE-2026-40682https://bugzilla.redhat.com/show_bug.cgi?id=2466484https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40682.json
2026-05-04
Published