CVE-2026-67211: Apache OpenNLP DOS Vulnerability

CVE-2026-67211 Overview

CVE-2026-67211 is a denial-of-service vulnerability in the Apache OpenNLP opennlp-spellcheck extension. The flaw resides in SymSpellModelSerializer.create(), which pre-sizes a LinkedHashMap using attacker-controlled 32-bit count fields read from a binary SymSpell model file. Because only a non-negative check is applied, a crafted .bin model can force the JVM to allocate multi-gigabyte backing arrays and terminate with an OutOfMemoryError. The issue affects Apache OpenNLP versions 3.0.0-M4 and 3.0.0-M5. Releases in the 1.x and 2.x branches do not contain the affected code.

Critical Impact

Any process that loads a SymSpell model from untrusted or semi-trusted origin can be crashed by a payload under 100 bytes, resulting in denial of service against services embedding OpenNLP spell-check functionality.

Affected Products

• Apache OpenNLP 3.0.0-M4
• Apache OpenNLP 3.0.0-M5
• The opennlp-spellcheck extension distributed in the official OpenNLP binary package

Discovery Timeline

• 2026-09-11 - CVE-2026-67211 published to NVD
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-67211

Vulnerability Analysis

The vulnerability is a classic memory allocation with excessive size weakness classified as [CWE-789]. The SymSpellModelSerializer.create() method reads two 32-bit signed integers, unigramCount and bigramCount, from the binary model stream. Both values are passed directly to LinkedHashMap.newLinkedHashMap() after a single check that they are non-negative.

With no upper bound applied, an attacker who controls the input file can set either count to Integer.MAX_VALUE. The map is then pre-sized to a capacity of 2^30 entries. The oversized backing array is allocated on the first put() into the map, requesting 4 to 8 GB of heap depending on whether compressed object pointers are in effect. The load fails with an OutOfMemoryError and the hosting JVM typically becomes unstable or terminates.

Root Cause

The root cause is missing upper-bound validation on length-prefixed count fields during deserialization. The count fields sit immediately after a fixed-size header containing the magic bytes, format version, three UTF strings, configuration fields, and the edit-distance identifier. This proximity means the malicious value can be placed at a known offset without inflating the file. A payload well under 100 bytes plus a single real entry is sufficient to trigger heap exhaustion.

Attack Vector

Exploitation requires the target process to deserialize an attacker-supplied SymSpell model. Vulnerable code paths include SymSpellModels.deserialize(InputStream), SymSpellModels.fromBytes(byte[]), classpath model loading via SymSpellModelResolver.resolveByLanguage(String), the CorrectTextTool command-line utility, and model-archive loading through the registered ArtifactSerializer. Any service that accepts user-uploaded dictionaries or fetches models from third-party repositories without integrity verification is exposed.

The vulnerability is described in prose because no verified exploit code is public. See the Apache Mailing List Discussion and the Openwall OSS Security Update for the official disclosure.

Detection Methods for CVE-2026-67211

Indicators of Compromise

• JVM process termination or restart accompanied by java.lang.OutOfMemoryError: Java heap space referencing SymSpellModelSerializer.create in the stack trace.
• Small SymSpell .bin files (under a few hundred bytes) submitted to services that legitimately consume large dictionaries.
• Unexpected LinkedHashMap allocations sized near 2^30 entries in heap dumps.

Detection Strategies

• Inventory applications embedding opennlp-spellcheck version 3.0.0-M4 or 3.0.0-M5 using software composition analysis against Maven coordinates.
• Alert on JVM crash telemetry or supervisor restarts correlating with SymSpell model ingestion events.
• Inspect model files at the ingress layer and parse the unigramCount and bigramCount header fields, rejecting any value that exceeds expected dictionary sizes.

Monitoring Recommendations

• Ship JVM garbage collection logs, heap-dump-on-OOM artifacts, and process exit codes into a centralized logging pipeline for correlation.
• Track file-upload endpoints that accept .bin artifacts and baseline typical file sizes and hashes against known-good dictionaries.
• Monitor outbound fetches from application servers to third-party model repositories and enforce checksum verification before load.

How to Mitigate CVE-2026-67211

Immediate Actions Required

• Upgrade Apache OpenNLP to version 3.0.0-M6, which enforces an upper bound on both count fields before pre-sizing the map.
• Audit application code for calls to SymSpellModels.deserialize, SymSpellModels.fromBytes, and SymSpellModelResolver.resolveByLanguage and restrict input sources.
• Treat all externally supplied SymSpell .bin files as untrusted until provenance and integrity are verified.

Patch Information

The fix in 3.0.0-M6 promotes the existing AbstractModelReader.MAX_ENTRIES limit to public visibility so binary serializers share a common bound. Counts that are negative or exceed the limit cause an IOException to be thrown before any large allocation. The default bound is 10,000,000 entries, well above legitimate SymSpell dictionaries. Deployments requiring larger dictionaries can raise the limit at JVM startup with -DOPENNLP_MAX_ENTRIES=50000000; invalid or non-positive values fall back to the default. This property is shared with the model-reader limit, so raising it relaxes both.

Workarounds

• Restrict SymSpell model loading to files signed or hashed by a trusted internal source.
• Sandbox the JVM process consuming untrusted models with a heap limit and automatic restart to contain OOM impact.
• Disable or remove the opennlp-spellcheck extension entirely if the application does not require spell-check functionality.

# Configuration example: raise the shared entry bound at JVM startup
java -DOPENNLP_MAX_ENTRIES=50000000 -Xmx4g -XX:+HeapDumpOnOutOfMemoryError -jar your-app.jar