CVE-2026-43825: Apache OpenNLP SvmDoccatModel Unsafe Deserialization RCE

Technical summary

CVE-2026-43825 is an unsafe Java deserialization vulnerability in SvmDoccatModel.deserialize(InputStream). The method uses ObjectInputStream.readObject() without installing an ObjectInputFilter, allowing the JVM to instantiate arbitrary classes from the serialized stream. Because object graph materialization occurs before the type cast to SvmDoccatModel, gadget chain exploitation is possible if vulnerable transitive dependencies (e.g., commons-collections, spring-core) are present on the classpath. The method is public and static, so any code path that receives an untrusted InputStream can trigger deserialization. While OpenNLP itself does not ship known gadget chains, downstream consumers embedding the libsvm module face realistic RCE risk.

Business impact

Successful exploitation leads to remote code execution within the JVM process that deserializes the malicious model file. Depending on deployment context, this could compromise data confidentiality and integrity, disrupt NLP-powered services, or pivot to lateral attacks within the application environment. Organizations using OpenNLP for document categorization—especially those accepting model files from third parties or user uploads—face direct operational and security risk. The impact is mitigated somewhat by the requirement that gadget chains be present in the application's dependency tree, but this is common in enterprise Java ecosystems.

Affected systems

Apache OpenNLP versions before 3.0.0-M4 are affected, specifically the 3.x line where the libsvm document categorization module was introduced (OPENNLP-1808). Applications or services that instantiate SvmDoccatModel by calling deserialize() on untrusted input streams are vulnerable. Risk is elevated for systems that: load serialized models from user-supplied files, fetch models from remote sources, or accept model data via network APIs without integrity verification. Applications using OpenNLP 1.x or 2.x are not affected.

Exploitability

Exploitation requires two conditions: (1) the ability to supply a crafted serialized stream to SvmDoccatModel.deserialize(), and (2) the presence of at least one Java deserialization gadget chain in the application classpath. The first condition is trivially met for any public-facing API that accepts model files. The second is common in modern Java applications (e.g., spring-core, commons-collections are widely used). The attack vector is network-accessible with no privilege or user interaction required, though exploitation success depends on the specific gadget chains available. This is categorized HIGH severity (CVSS 7.3) rather than CRITICAL due to the gadget chain dependency, but should be treated as urgent in any environment where both conditions exist.

Remediation

Upgrade to Apache OpenNLP 3.0.0-M4 or later immediately. This release includes proper ObjectInputFilter validation. For applications unable to patch immediately, implement strict controls: verify the provenance and integrity of all serialized SvmDoccatModel files before deserialization (e.g., cryptographic signatures, checksummed imports from trusted repositories), avoid calling deserialize() on user-supplied or third-party streams, and isolate the OpenNLP service with network segmentation and JVM sandboxing where feasible. Review your application's transitive dependencies to identify and reduce exposure to known gadget chain libraries.

Patch guidance

Apache OpenNLP 3.0.0-M4 or later contains the fix. Consult the official Apache OpenNLP release notes and security advisories to confirm patch availability for your deployment model. If you are on the 3.x development line, ensure your build pulls from the stable milestone release or later. No patches are available or needed for the 1.x or 2.x lines, as the vulnerable code does not exist in those branches.

Detection guidance

Monitor for: (1) calls to SvmDoccatModel.deserialize() in code that processes external input, (2) serialized files with OpenNLP model signatures arriving from unexpected sources, (3) unusual process spawning, network connections, or file access following model deserialization operations, (4) exceptions or errors during SvmDoccatModel instantiation that may indicate gadget chain exploitation attempts. Log all model file loads with source and timestamp. In network-based detection, look for suspicious serialized Java object streams (magic bytes: AC ED 00 05) being sent to OpenNLP endpoints. Update your Java deserialization monitoring rules to specifically flag SvmDoccatModel class references in ObjectInputStream logs.

Why prioritize this

This vulnerability should be treated as high priority due to the combination of network accessibility, lack of authentication requirements, and the potential for remote code execution. While gadget chain availability limits the scope, it is a common condition in enterprise Java deployments. Any organization running OpenNLP 3.x and accepting model files from external sources, or embedding OpenNLP in user-facing applications, should prioritize patching within 1–2 weeks. Organizations with strict network segmentation, trusted-source-only model loading, or no transitive gadget chain dependencies can extend the timeline slightly, but should still plan patching.

Risk score, explained

CVSS 7.3 (HIGH) reflects network accessibility (AV:N), low attack complexity (AC:L), no privilege or user interaction (PR:N, UI:N), and direct impact on confidentiality, integrity, and availability (C:L, I:L, A:L). The score does not account for the gadget chain dependency, which in practice reduces exploitability; however, given how common vulnerable transitive dependencies are in Java environments, the CVSS base score appropriately reflects the realistic threat level. An organization-specific risk rating should also consider your OpenNLP version, whether you accept external models, and your transitive dependency inventory.

Frequently asked questions