CVE-2026-82617

The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULT_REGEX_NAME_FINDER.EMAIL and DEFAULT_REGEX_NAME_FINDER.URL - contain ambiguous nested quantifiers. An application that obtains these finders through RegexNameFinderFactory.getDefaultRegexNameFinders(...) and then applies them to untrusted text through RegexNameFinder.find(String[]) or RegexNameFinder.find(String) can be driven into super-linear backtracking or into unbounded matcher recursion by a small crafted input. For the EMAIL pattern, a long run of local-part characters that is never followed by an @ forces the matcher to re-scan to end-of-input from every starting offset. Cost grows quadratically with input length: an input of approximately 32 KB consumes several seconds of CPU in a single find() call and returns no match, and each doubling of the input multiplies the cost roughly four-fold. For the URL pattern, the query-string sub-expression nests a capturing repetition inside an outer repetition. The JDK matcher recurses once per query token, so an input of approximately 4 KB containing many &-separated tokens exhausts the thread stack and causes java.lang.StackOverflowError to propagate out of find(), terminating the calling thread. On a thread created with a smaller stack (for example -Xss512k, typical of server worker pools) approximately 1 KB is sufficient. In both cases an attacker who can supply text for analysis can convert a single request into seconds to minutes of pinned CPU, or into an abrupt thread death, denying service to the embedding application. No authentication, special configuration, or model file is required beyond the application having selected one of the two built-in finders. This issue affects Apache OpenNLP: from 2.0.0 through 2.5.11; from 3.0.0-M1 through 3.0.0-M5. Users are recommended to upgrade to version 2.5.12, or to 3.0.0-M6 for users tracking the 3.0.0 milestone line, which fix the issue.

• CWE-1333

• https://lists.apache.org/thread/spzhcxxszqdpppg70m1zz2l3mv29mhl3Mailing List, Vendor Advisory
• https://www.openwall.com/lists/oss-security/2026/09/11/10Mailing List, Third Party Advisory

Published

Sep 11, 2026

Last Modified

Sep 16, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-82611A weakness has been identified in itsourcecode Online Medici…7.3
• CVE-2026-82612A security vulnerability has been detected in itsourcecode O…7.3
• CVE-2026-82613A vulnerability was detected in itsourcecode Online Medicine…7.3
• CVE-2026-82614A flaw has been found in itsourcecode Online Medicine Delive…7.3
• CVE-2026-82615A vulnerability has been found in itsourcecode Online Medici…7.3
• CVE-2026-82616A vulnerability was found in TOTOLINK NR1800X 9.1.0u.6681_B2…9.9
• CVE-2026-82618A vulnerability was determined in Systerel S2OPC up to 1.7.3…4.3
• CVE-2026-82619A vulnerability was identified in Systerel S2OPC up to 1.7.3…4.3
• CVE-2026-8262A vulnerability was identified in Devs Palace ERP Online up …2.4
• CVE-2026-82620A security flaw has been discovered in Soarkey StudentManage…6.3
• CVE-2026-82621A weakness has been identified in Soarkey StudentManagement …7.3
• CVE-2026-82622A security vulnerability has been detected in code-projects …3.5