- High 7.3
CVE-2026-43825
Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel Versions Affected: before 3.0.0-M4 (libsvm document categorization module; introduced in OPENNLP-1808 and only present on the 3.x line) Description: SvmDoccatModel.deserialize(InputStream) reads an attacker-controlled stream with java.io.ObjectInputStream and calls readObject() without an ObjectInputFilter installed. ObjectInputStream materialises every class referenced in the stream before the resulting object is cast to SvmDoccatModel, so the cast that follows readObject() executes only after the foreign object graph has alread…
Scores
The facts
- Published
- 6 July 2026
- Last changed
- 8 July 2026
- NVD status
- Analyzed
- Severity
- High, CVSS 7.3 out of 10 (version 3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- Affects
- apache opennlp
- Known exploited
- Not in the CISA Known Exploited Vulnerabilities catalogue in this build.
- EPSS
- 13.9% chance of exploitation activity in the next 30 days (percentile 97).
Is there a Securelyn advisory?
Not yet. Securelyn writes plain-English advisories for the flaws that matter most to businesses. Subscribe to the digest to hear about them.