Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

Apache OpenNLP DictionaryEntryPersistor Vulnerable to XML External Entity (XXE) via Unsanitized Dictionary Parsing

Fix availableCritical · CVSS 9.1EPSS 0.84%

Published May 4, 2026 · updated Oct 2, 2026

What to do

  1. Upgrade to a fixed version: org.apache.opennlp:opennlp-tools 3.0.0-M3, org.apache.opennlp:opennlp-tools 2.5.9, org.apache.opennlp:opennlp-tools 1.9.5.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Mavenorg.apache.opennlp:opennlp-tools

Vulnerable versions
>= 3.0.0-M1, < 3.0.0-M3
Fixed in
3.0.0-M3

Check your project: mvn dependency:tree -Dincludes=org.apache.opennlp:opennlp-tools

Mavenorg.apache.opennlp:opennlp-tools

Vulnerable versions
>= 2.0.0, < 2.5.9
Fixed in
2.5.9

Check your project: mvn dependency:tree -Dincludes=org.apache.opennlp:opennlp-tools

Mavenorg.apache.opennlp:opennlp-tools

Vulnerable versions
< 1.9.5
Fixed in
1.9.5

Check your project: mvn dependency:tree -Dincludes=org.apache.opennlp:opennlp-tools

Sources

CWE-611 Improper Restriction of XML External Entity Reference

← All critical vulnerabilities