CVE-2026-42027
published 2026-05-04CVE-2026-42027: Arbitrary Class Instantiation via Model Manifest in Apache OpenNLP ExtensionLoader Versions Affected: before 1.9.5, before 2.5.9, before 3.0.0-M3 Description…
PriorityP264critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.67%
48.1th percentile
Arbitrary Class Instantiation via Model Manifest in Apache OpenNLP ExtensionLoader
Versions Affected: before 1.9.5, before 2.5.9, before 3.0.0-M3
Description:
The ExtensionLoader.instantiateExtension(Class, String) method loads a class by its fully-qualified name via Class.forName() and invokes its no-arg constructor, with the class name sourced from the manifest.properties entry of a model archive. The existing isAssignableFrom check correctly rejects classes that are not subtypes of the expected extension interface (BaseToolFactory for factory=, ArtifactSerializer for serializer-class-*), but the check runs after Class.forName() has already loaded and initialized the named class.
Class.forName() with default initialization semantics executes the target class's static initializer before returning, so an attacker who can supply a crafted model archive can cause the static initializer of any class on the classpath to run during model loading, regardless of whether that class passes the subsequent type check.
Exploitation requires a class with attacker-useful side effects in its static initializer (for example, JNDI lookup, outbound network I/O, or filesystem access) to be present on the classpath, so this is not a drop-in remote code execution; however, the attack surface grows as third-party model distribution becomes more common (community model repositories, Hugging Face-style sharing), where users routinely load model files from origins they do not control. A secondary, narrower vector affects deployments that ship legitimate BaseToolFactory or ArtifactSerializer subclasses with side-effecting no-arg constructors: a malicious manifest can name such a class and force its constructor to run during model load.
Mitigation:
* 2.x users should upgrade to 2.5.9.
* 3.x users should upgrade to 3.0.0-M3.
Note: The fix introduces a package-prefix allowlist that is consulted before Class.forName() is invoked, so the static initializer of a disallowed class is ne
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | opennlp | < 2.5.9 | 2.5.9 |
| apache | opennlp | — | — |
| apache | opennlp | — | — |
| apache_software_foundation | apache_opennlp | < 1.9.5 | 1.9.5 |
| apache_software_foundation | apache_opennlp | >= 2.0 < 2.5.9 | 2.5.9 |
| apache_software_foundation | apache_opennlp | >= 3.0.0-M1 < 3.0.0-M3 | 3.0.0-M3 |
| rhoai | odh-trustyai-service-rhel8 | — | — |
| rhoai | odh-trustyai-service-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-trustyai-cpu-py312-rhel9 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Malicious model archive contains a crafted manifest.properties entry specifying a fully-qualified class name to force static initializer execution via Class.forName() during model loading ↗
- →Monitor for unexpected JNDI lookups, outbound network I/O, or filesystem access triggered during Apache OpenNLP model loading — these are the attacker-useful side effects exploited via static initializer execution ↗
- →Audit classpath for classes with side-effecting static initializers or constructors, particularly those performing JNDI lookups, network requests, or filesystem operations during class initialization ↗
- →The vulnerable code path is ExtensionLoader.instantiateExtension(Class, String) — monitor or instrument this method for class names outside the opennlp.* package prefix being passed to Class.forName() ↗
- →Inspect model archive manifest.properties for factory= or serializer-class-* keys referencing class names outside the opennlp.* namespace as an indicator of a crafted/malicious model file ↗
- ·The fix introduces a package-prefix allowlist checked before Class.forName() is invoked; deployments loading models with factories or serializers outside opennlp.* must explicitly register allowed packages or the model load will fail ↗
- ·A secondary attack vector exists for deployments shipping legitimate BaseToolFactory or ArtifactSerializer subclasses with side-effecting no-arg constructors — a malicious manifest can name such a class and force its constructor to run ↗
- ·Red Hat Fuse 7 is listed as 'Will not fix' for the opennlp-tools package, meaning affected deployments on that platform will remain vulnerable ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-cx4m-2p55-rw7j: Arbitrary Class Instantiation via Model Manifest in Apache OpenNLP ExtensionLoader
Versions Affected: before 2
ghsa_unreviewed·2026-05-04
CVE-2026-42027 [CRITICAL] CWE-470 GHSA-cx4m-2p55-rw7j: Arbitrary Class Instantiation via Model Manifest in Apache OpenNLP ExtensionLoader
Versions Affected: before 2
Arbitrary Class Instantiation via Model Manifest in Apache OpenNLP ExtensionLoader
Versions Affected: before 2.5.9, before 3.0.0-M3
Description:
The ExtensionLoader.instantiateExtension(Class, String) method loads a class by its fully-qualified name via Class.forName() and invokes its no-arg constructor, with the class name sourced from the manifest.properties entry of a model archive. The existing isAssignableFrom check correctly rejects classes that are not subtypes of the expected extension interface (BaseToolFactory for factory=, ArtifactSerializer for serializer-class-*), but the check runs after Class.forName() has already loaded and initialized the named class.
Class.forName() with default initialization semantics executes the target class's static initializer before returning
GHSA
Apache OpenNLP ExtensionLoader Vulnerable to Arbitrary Class Instantiation via Model Manifest
ghsa·2026-05-04
CVE-2026-42027 [CRITICAL] CWE-470 Apache OpenNLP ExtensionLoader Vulnerable to Arbitrary Class Instantiation via Model Manifest
Apache OpenNLP ExtensionLoader Vulnerable to Arbitrary Class Instantiation via Model Manifest
Arbitrary Class Instantiation via Model Manifest in Apache OpenNLP ExtensionLoader
Versions Affected: before 2.5.9, before 3.0.0-M3
Description:
The ExtensionLoader.instantiateExtension(Class, String) method loads a class by its fully-qualified name via Class.forName() and invokes its no-arg constructor, with the class name sourced from the manifest.properties entry of a model archive. The existing isAssignableFrom check correctly rejects classes that are not subtypes of the expected extension interface (BaseToolFactory for factory=, ArtifactSerializer for serializer-class-*), but the check runs after Class.forName() has already loaded and initialized the named class.
Class.forName() with d
VulDB
Apache OpenNLP up to 2.5.8/3.0.0-M2 Model Manifest ExtensionLoader privilege escalation
vuldb·2026-05-01
CVE-2026-42027 [CRITICAL] Apache OpenNLP up to 2.5.8/3.0.0-M2 Model Manifest ExtensionLoader privilege escalation
A vulnerability was found in Apache OpenNLP up to 2.5.8/3.0.0-M2. It has been classified as critical. The impacted element is the function ExtensionLoader of the component Model Manifest. The manipulation leads to privilege escalation.
This vulnerability is referenced as CVE-2026-42027. Remote exploitation of the attack is possible. No exploit is available.
Upgrading the affected component is recommended.
Red Hat
Apache OpenNLP: Apache OpenNLP: Arbitrary Class Loading via Model Manifest
vendor_redhat·2026-05-04·CVSS 9.8
CVE-2026-42027 [CRITICAL] CWE-502 Apache OpenNLP: Apache OpenNLP: Arbitrary Class Loading via Model Manifest
Apache OpenNLP: Apache OpenNLP: Arbitrary Class Loading via Model Manifest
A flaw was found in Apache OpenNLP. An attacker, by providing a specially crafted model archive, can exploit a vulnerability in the ExtensionLoader component. This allows the attacker to force the system to load and initialize any class present on the classpath, executing its static initializer. While not direct remote code execution, this could lead to unintended actions such as network communication or file system operations, depending on the classes available in the environment.
Package: opennlp-tools (Red Hat build of Apache Camel for Spring Boot 4) - Not affected
Package: opennlp-tools (Red Hat Data Grid 8) - Affected
Package: opennlp-tools (Red Hat Fuse 7) - Will not fix
Package: opennlp-tools (Red Hat JB
No detection rules found.
No public exploits indexed.
https://lists.apache.org/thread/ltlo4powjfc0w2w2yyl1o5tc7q1gcb2yhttp://www.openwall.com/lists/oss-security/2026/05/01/20https://access.redhat.com/security/cve/CVE-2026-42027https://bugzilla.redhat.com/show_bug.cgi?id=2466527https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42027.json
2026-05-04
Published