CVE-2026-43825

Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel Versions Affected:   before 3.0.0-M4 (libsvm document categorization module; introduced in   OPENNLP-1808 and only present on the 3.x line) Description: SvmDoccatModel.deserialize(InputStream) reads an attacker-controlled stream with java.io.ObjectInputStream and calls readObject() without an ObjectInputFilter installed. ObjectInputStream materialises every class referenced in the stream before the resulting object is cast to SvmDoccatModel, so the cast that follows readObject() executes only after the foreign object graph has already been deserialised in full. If a Java deserialization gadget chain is available on the consumer's classpath, a crafted payload supplied to deserialize() executes arbitrary code in the JVM that loads it. Apache OpenNLP itself does not ship a known gadget chain, so the realistic risk is to downstream applications that embed the libsvm module alongside vulnerable transitive dependencies. The method is public and static, so any caller can pass an untrusted stream to it directly. The practical impact is remote code execution against processes that load SvmDoccatModel instances from untrusted or semi-trusted origins. Mitigation: 3.x users should upgrade to 3.0.0-M4. Users who cannot upgrade immediately should treat all serialized SvmDoccatModel streams as untrusted input unless their provenance is verified, and should avoid invoking SvmDoccatModel.deserialize() on streams supplied by end users or fetched from third-party sources without integrity checks.

• CWE-502

• https://lists.apache.org/thread/c7kom0pgk9cbpfnbooh5m3g85ndf50hnMailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2026/07/06/9Mailing List, Third Party Advisory

Published

Jul 6, 2026

Last Modified

Jul 8, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-43819An access issue was addressed with additional sandbox restri…5.5
• CVE-2026-43820NIOSSLCertificate._subjectAlternativeNames provides access t…7.7
• CVE-2026-43821An access issue was addressed with improved access restricti…6.5
• CVE-2026-43822A use after free issue was addressed with improved memory ma…9.8
• CVE-2026-43823When initializing an RSA public key from DER or PEM bytes th…7.5
• CVE-2026-43824In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, Serve…7.7
• CVE-2026-43826The OpenSearch logging provider, when configured with a `hos…6.5
• CVE-2026-43827Default configurations of Apache Shiro have a session fixati…6.5
• CVE-2026-43828Default configurations of Apache Shiro send sensitive cookie…6.5
• CVE-2026-43829Full details and mitigation steps are currently restricted a…7.5
• CVE-2026-43830Full details and mitigation steps are currently restricted a…9.8
• CVE-2026-43831Full details and mitigation steps are currently restricted a…7.5