CVE-2026-43825: Apache OpenNLP RCE Vulnerability

CVE-2026-43825 Overview

CVE-2026-43825 is an untrusted Java deserialization vulnerability in Apache OpenNLP's SvmDoccatModel class. The flaw resides in the libsvm document categorization module introduced in OPENNLP-1808 on the 3.x branch. The static method SvmDoccatModel.deserialize(InputStream) reads an attacker-controlled stream through java.io.ObjectInputStream and invokes readObject() without installing an ObjectInputFilter. Any caller can pass an untrusted stream directly to this public static method. When a Java deserialization gadget chain exists on the consumer's classpath, a crafted payload achieves remote code execution inside the JVM. The vulnerability is tracked under [CWE-502: Deserialization of Untrusted Data].

Critical Impact
Remote code execution is possible against processes that load SvmDoccatModel instances from untrusted or semi-trusted origins when a compatible gadget chain is present on the classpath.

Affected Products

Apache OpenNLP 3.0.0-M1
Apache OpenNLP 3.0.0-M2
Apache OpenNLP 3.0.0-M3

Discovery Timeline

2026-07-06 - CVE-2026-43825 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-43825

Vulnerability Analysis

The vulnerability exists in the libsvm document categorization module of Apache OpenNLP 3.x. The public static method SvmDoccatModel.deserialize(InputStream) accepts an arbitrary InputStream, wraps it with ObjectInputStream, and calls readObject(). Java's ObjectInputStream materializes every class referenced in the serialized graph before the returned object is cast to SvmDoccatModel. The type cast executes only after the entire foreign object graph has already been deserialized. Any side effects triggered during deserialization run inside the loading JVM before type safety is enforced.

Apache OpenNLP itself does not ship a known gadget chain. The practical exposure applies to downstream applications that embed the libsvm document categorization module alongside vulnerable transitive dependencies that provide reachable gadget chains such as those in older Commons Collections, Spring, or similar libraries.

Root Cause

The root cause is the absence of an ObjectInputFilter on the ObjectInputStream used inside SvmDoccatModel.deserialize(InputStream). Without a filter, no class allow-list or reject-list constrains what types the stream may instantiate. The method's public and static signature also removes any encapsulation, allowing any caller to hand it an attacker-controlled stream directly.

Attack Vector

The attack vector is network-reachable. An attacker supplies a crafted serialized byte stream that is passed into SvmDoccatModel.deserialize(), typically because the application loads model files from user uploads, remote URLs, shared storage, or third-party model repositories without integrity verification. When the stream references classes belonging to a known gadget chain on the consumer's classpath, the deserialization triggers arbitrary code execution in the JVM. No authentication or user interaction is required at the OpenNLP layer.

No public proof-of-concept exploit or CISA KEV listing is associated with this CVE. The vulnerability mechanism is described in the Apache Mailing List Thread and the OpenWall OSS-Security Update.

Detection Methods for CVE-2026-43825

Indicators of Compromise

Unexpected child processes spawned by Java application servers that embed Apache OpenNLP, particularly shells, curl, wget, or scripting interpreters.
Outbound network connections from JVM processes to unknown hosts shortly after loading a document categorization model.
Presence of serialized Java payload magic bytes (AC ED 00 05) in files or HTTP request bodies routed to model-loading endpoints.

Detection Strategies

Inventory application classpaths for apache:opennlp versions 3.0.0-M1 through 3.0.0-M3 and flag any calls to SvmDoccatModel.deserialize().
Instrument or monitor JVMs for ObjectInputStream.readObject() calls originating from OpenNLP packages without an active ObjectInputFilter.
Correlate model-file ingestion events with subsequent process creation or network activity to surface deserialization-triggered execution.

Monitoring Recommendations

Log and alert on any file uploads or fetches that supply .bin or serialized model artifacts to services embedding OpenNLP.
Track JVM crash reports and ClassCastException traces that reference SvmDoccatModel after readObject() frames.
Baseline outbound network egress from Java services performing NLP workloads and alert on deviations.

How to Mitigate CVE-2026-43825

Immediate Actions Required

Upgrade Apache OpenNLP to 3.0.0-M4 or later on all 3.x deployments that include the libsvm document categorization module.
Treat every serialized SvmDoccatModel stream as untrusted until its provenance and integrity are verified.
Remove or disable code paths that pass end-user or third-party streams into SvmDoccatModel.deserialize().
Audit transitive dependencies for libraries known to expose Java deserialization gadget chains and remove or update them.

Patch Information

Apache has fixed the vulnerability in Apache OpenNLP 3.0.0-M4. The remediation addresses SvmDoccatModel.deserialize(InputStream) so that untrusted class graphs are no longer materialized without constraints. Refer to the Apache Mailing List Thread for the official advisory.

Workarounds

Restrict SvmDoccatModel.deserialize() callers to trusted, signed model files stored on integrity-protected storage.
Verify cryptographic hashes or digital signatures of model artifacts before invoking deserialization.
Install a process-wide ObjectInputFilter via -Djdk.serialFilter that rejects classes outside the expected OpenNLP model types.
Isolate services that must load external models inside sandboxed containers with restricted egress and least-privilege file system access.

bash

# Configuration example: JVM-wide serialization allow-list
java -Djdk.serialFilter='opennlp.tools.**;java.lang.*;java.util.*;!*' \
     -jar your-application.jar