CVE-2026-43825 Apache OpenNLP :: Core :: ML :: LibSVM: Unsafe Java Deserialization in SvmDoccatModel
Attackers can execute arbitrary code by supplying malicious serialized data to the SvmDoccatModel deserialization method in Apache OpenNLP.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-43825?
CVE-2026-43825 is a high-severity unsafe deserialization vulnerability in Apache OpenNLP :: Core :: ML :: LibSVM, published on 6 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel
Versions Affected: before 3.0.0-M4 (libsvm document categorization module; introduced in OPENNLP-1808 and only present on the 3.x line)
Description: SvmDoccatModel.deserialize(InputStream) reads an attacker-controlled stream with java.io.ObjectInputStream and calls readObject() without an ObjectInputFilter installed. ObjectInputStream materialises every class referenced in the stream before the resulting object is cast to SvmDoccatModel, so the cast that follows readObject() executes only after the foreign object graph has already been deserialised in full.
If a Java deserialization gadget chain is available on the consumer's classpath, a crafted payload supplied to deserialize() executes arbitrary code in the JVM that loads it. Apache OpenNLP itself does not ship a known gadget chain, so the realistic risk is to downstream applications that embed the libsvm module alongside vulnerable transitive dependencies. The method is public and static, so any caller can pass an untrusted stream to it directly.
The practical impact is remote code execution against processes that load SvmDoccatModel instances from untrusted or semi-trusted origins.
Mitigation:
3.x users should upgrade to 3.0.0-M4.
Users who cannot upgrade immediately should treat all serialized SvmDoccatModel streams as untrusted input unless their provenance is verified, and should avoid invoking SvmDoccatModel.deserialize() on streams supplied by end users or fetched from third-party sources without integrity checks.
Weakness: CWE-502
Which versions are affected by CVE-2026-43825?
It affects 1 product.
Products include Apache Opennlp.
How do I fix CVE-2026-43825?
No fix has been published for CVE-2026-43825 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-43825 being exploited?
There is no known exploitation of CVE-2026-43825 in the wild and no public exploit code.
Other vulnerabilities in Apache OpenNLP :: Core :: ML :: LibSVM
- CVE-2026-82617 Apache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns
- CVE-2026-42027 Apache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoader
- CVE-2017-12620 Improper Restriction of XML External Entity Reference in Apache OpenNLP
- CVE-2026-40682 Apache OpenNLP: XXE via Dictionary Parsing in DictionaryEntryPersistor
- CVE-2026-67211 Apache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializer
Sources
Also known as GHSA-g4fv-7mf3-543r, UBUNTU-CVE-2026-43825.