CVE-2026-42027: 
Java vulnerability analysis and mitigation

CVE-2026-42027 is an arbitrary class instantiation vulnerability in the Apache OpenNLP ExtensionLoader component, classified as Critical with a CVSS v3.1 base score of 9.8. It affects org.apache.opennlp:opennlp-tools versions before 2.5.9 and 3.0.x versions before 3.0.0-M3 (including 3.0.0-M1 and 3.0.0-M2). The vulnerability was disclosed on May 1, 2026 via the oss-security mailing list, with the GitHub Advisory published on May 4, 2026. Patches were released by Apache on May 1, 2026 (GitHub Advisory, oss-security).

The root cause is CWE-470 (Use of Externally-Controlled Input to Select Classes or Code / Unsafe Reflection). The ExtensionLoader.instantiateExtension(Class, String) method reads a fully-qualified class name from the manifest.properties file embedded in a model archive and loads it via Class.forName(), which — by default — executes the target class's static initializer block before returning. The isAssignableFrom type-safety check that is supposed to restrict which classes can be used runs after Class.forName() has already initialized the class, meaning an attacker who supplies a crafted model archive can trigger the static initializer of any class present on the classpath, regardless of whether it passes the type check. A secondary vector exists for deployments shipping BaseToolFactory or ArtifactSerializer subclasses with side-effecting no-arg constructors, where a malicious manifest can force constructor execution during model load (GitHub Advisory, oss-security).

An unauthenticated, remote attacker who can supply a crafted model archive to a vulnerable OpenNLP deployment can trigger the static initializer of any class on the application's classpath during model loading. Depending on the classes available, this can result in JNDI lookups (enabling potential remote code execution via deserialization gadget chains), outbound network I/O, or unauthorized filesystem access — all executing with the privileges of the OpenNLP process. The risk is amplified in environments that consume third-party or community-shared model files (e.g., Hugging Face-style repositories), where model provenance is not guaranteed, and grows with the breadth of the classpath (GitHub Advisory, oss-security).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.47–0.72% (73rd percentile), indicating a moderate near-term exploitation probability relative to other CVEs. No threat actor attribution has been reported. The attack requires no authentication and no user interaction, but does require the attacker to be able to supply a crafted model archive to the target system and relies on the presence of exploitable classes on the classpath.

1. Reconnaissance: Identify applications or services that use Apache OpenNLP (opennlp-tools < 2.5.9 or 3.0.0-M1/M2) and accept or load model archives from external or user-controlled sources (e.g., community model repositories, file upload endpoints).
2. Classpath analysis: Determine which classes are available on the target's classpath that have exploitable side effects in their static initializers — for example, classes performing JNDI lookups (common in Log4j-style gadgets), outbound HTTP requests, or filesystem writes.
3. Craft malicious model archive: Create a valid OpenNLP model archive (ZIP/JAR format) and modify its manifest.properties file to set the factory= or serializer-class-* entry to the fully-qualified name of the target class with the exploitable static initializer.
4. Deliver the crafted archive: Supply the malicious model archive to the target application — via a file upload feature, a shared model repository, or any other mechanism by which the application loads model files.
5. Trigger model loading: Cause the application to load the crafted model archive, which invokes ExtensionLoader.instantiateExtension(), which calls Class.forName() on the attacker-specified class name, executing its static initializer.
6. Achieve objective: The static initializer executes attacker-controlled logic (e.g., JNDI lookup to an attacker-controlled server, triggering a deserialization payload for RCE, or exfiltrating data via outbound network I/O) with the privileges of the OpenNLP process (GitHub Advisory, oss-security).

• Network: Unexpected outbound LDAP, RMI, or DNS requests from the JVM process hosting OpenNLP (indicative of JNDI lookup triggered during class initialization); outbound HTTP/HTTPS connections to unknown external hosts initiated by the OpenNLP service process.
• Logs: Application logs showing ClassNotFoundException or unexpected class loading errors for unusual fully-qualified class names during model load operations; Java stack traces referencing ExtensionLoader.instantiateExtension with non-opennlp.* class names.
• File System: Unexpected model archive files (.bin, .zip, .jar) in model directories with manifest.properties entries referencing non-standard class names outside the opennlp.* package namespace.
• Process: Unusual child processes or network connections spawned by the Java process running OpenNLP; unexpected DNS resolution requests for attacker-controlled domains from the JVM.

Upgrade to Apache OpenNLP 2.5.9 (for 2.x users) or 3.0.0-M3 (for 3.x users). The fix introduces a package-prefix allowlist consulted before Class.forName() is invoked, preventing static initializer execution for disallowed classes; the opennlp.* prefix is permitted by default. Deployments loading models referencing factories or serializers outside opennlp.* must explicitly allow those packages via ExtensionLoader.registerAllowedPackage(String) or the OPENNLP_EXT_ALLOWED_PACKAGES system property. If immediate upgrade is not possible: restrict model loading to trusted, integrity-verified sources only; audit the classpath for classes with side-effecting static initializers or constructors (especially those performing JNDI lookups, network requests, or filesystem operations) (GitHub Advisory, oss-security).

The vulnerability was credited to finder Subramanian S and disclosed responsibly through Apache's security process (oss-security). Social media activity was limited but included posts on Bluesky and Mastodon noting the advisory shortly after disclosure. The Apache security team rated the severity as "moderate" in the oss-security disclosure, while NVD and GitHub Advisory Database assigned it a Critical CVSS score of 9.8, reflecting the no-authentication, network-accessible attack vector. Coverage was picked up by standard vulnerability aggregators (VulDB, Vulners, Tenable/Nessus plugin 312234, Qualys detection 6763417) shortly after publication.