Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

apache/opennlp

              main @ b2c0a90
            

Fixes

CVEs

CRITICAL

Peak severity

33.3%

Coverage

Highlights

Unsafe Deserialization: 1 prior fix. Scrutinize any change in this area.

opennlp-api/src/main/java/opennlp/tools/util/ext/ExtensionLoader.java: most-fixed (1 issue). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

XML External Entity (XXE): Parsing unsanitized dictionary files or models can allow attackers to perform local file disclosure or Server-Side Request Forgery (SSRF) via crafted inline DOCTYPE declarations or external entity definitions. Securing the central XmlUtil class is vital to protect Downstream parsers like DictionaryEntryPersistor.

Unsafe Reflection: Loading extensions dynamically via Class.forName() using class names specified in untrusted model manifests allows arbitrary class initialization. Attackers can leverage this to trigger malicious static initializers prior to type-checking.

Unsafe Deserialization: Untrusted object streams parsed during document categorization model loading can lead to remote code execution or denial of service if serialized gadget chains are processed without explicit class and resource filtering.