CVE-2026-40682

The DictionaryEntryPersistor class creates a static SAXParserFactory instance during class loading without enabling the FEATURE_SECURE_PROCESSING flag or disabling DTD processing. The only feature set on the XMLReader object is namespace handling — external entity resolution and DOCTYPE declarations remain fully active. An attacker can embed a malicious DOCTYPE declaration in a dictionary file (e.g., a stop-words list or domain dictionary) containing references to external resources: file:// references allow reading files from the local system, and http:// references cause the server to initiate network requests (SSRF) — all of this occurs before any dictionary entry is processed. Other XML parsing paths in the project use the XmlUtil.createSaxParser() helper method, which correctly sets FEATURE_SECURE_PROCESSING and disallow-doctype-decl — the DictionaryEntryPersistor class is the sole exception.

An attacker can gain unauthorized access to sensitive files on the local operating system (e.g., /etc/passwd) or force the server to execute HTTP requests to internal network resources (SSRF), which may enable further infrastructure reconnaissance or attack escalation.

Users on the 2.x branch should update Apache OpenNLP to version 2.5.9, and users on the 3.x branch to version 3.0.0-M3. If immediate updating is not possible, ensure that all dictionary files come only from trusted sources, and consider implementing input validation that rejects XML documents containing DOCTYPE declarations before passing them to the parser.

Apache OpenNLP in versions before 2.5.9 (2.x branch) and before 3.0.0-M3 (3.x branch); the vulnerability affects any code using the public Dictionary(InputStream) constructor or the DictionaryEntryPersistor.create(InputStream, EntryInserter) method with untrusted dictionary files