External risk intelligence

Apache OpenNLP Regex Name Finder Denial of Service

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-82617

This is a library vulnerability in Apache OpenNLP used for text processing. While it could be triggered via internet-facing applications that accept user-supplied text for analysis, it is a component embedded in custom software rather than a standalone network-facing service, making its exposure dependent on the specific implementation of the host application.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Apache OpenNLP's text analysis functions could allow an attacker to disrupt service by providing specially crafted input that consumes excessive CPU or causes application threads to crash. This issue affects applications using specific built-in name-finding patterns without requiring authentication or special configuration.

Text analysis flaw can crash applications.
Attackers can disrupt services with crafted input.
Assess if your use of OpenNLP is exposed.

Attack Path

How an attacker could exploit the issue

An attacker who can submit untrusted text to an application using the vulnerable library can trigger a denial-of-service condition. The application's text analysis process, specifically when using the built-in email or URL name finders, can be manipulated to consume excessive CPU resources or cause the application's thread to crash. This can be achieved without needing any special privileges or configuration, simply by crafting malicious input.

Requires attacker-supplied text input.
Triggered by parsing crafted text with name finders.
Leads to application resource exhaustion or crash.

Live Threat

Current exploitation, exposure, and threat context

When untrusted text is processed by applications using specific built-in name-finder patterns in Apache OpenNLP, it could lead to excessive CPU consumption or thread termination. This occurs when these patterns encounter crafted input designed to trigger super-linear backtracking or unbounded recursion, impacting the availability of the embedding application.

Application CPU cycles and threads.
Processing untrusted text input.
Denial of service for the application.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Apache OpenNLP's name-finder patterns likely impacts application owners who integrate this library for processing untrusted text. The first practical step is to identify all applications using the affected versions of OpenNLP, determine if they process external input with the name-finder patterns, and assess the business criticality and exposure of those applications before planning remediation.

Application owners should address this.
Verify affected applications and input sources.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Apache OpenNLP and how is it used?

Apache OpenNLP is a machine learning-based toolkit written in Java used for processing natural language text. Developers integrate it into software to perform tasks like tokenization, sentence segmentation, and named entity recognition. It helps applications identify and extract specific data, such as names, dates, or contact information, from large volumes of unstructured text.

What is the weakness class for CVE-2026-82617?

This vulnerability is classified as CWE-1333: Inefficient Regular Expression Complexity. It occurs because the built-in email and URL matching patterns contain nested quantifiers. When processing certain crafted inputs, these patterns can cause the regular expression engine to perform excessive backtracking or stack recursion, leading to severe resource depletion.

Do I need special access to trigger this vulnerability?

No. The vulnerability is triggered simply by supplying crafted text to an application that uses the affected OpenNLP regex finders. It does not require authentication, special configuration, or administrative privileges. If the application uses the default email or URL finders to process untrusted input, the trigger is purely data-driven.

Why does Halo Surface Signal categorize this as Possible?

Halo Surface Signal labels this as 'Possible' because Apache OpenNLP is an embedded library, not a standalone service. Its exposure depends entirely on your specific implementation. While the threat is external, your application is only vulnerable if it accepts and processes untrusted, user-supplied text using the specific built-in patterns identified in the advisory.

How should I respond to this threat?

First, conduct an inventory to identify all applications using OpenNLP versions 2.0.0 through 2.5.11 or 3.0.0-M1 through 3.0.0-M5. Determine which of these applications process untrusted user input using the built-in email or URL regex finders. Once identified, prioritize upgrading these systems to version 2.5.12 or 3.0.0-M6 to implement the necessary pattern corrections.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.