CVE-2026-67211 Apache Software Foundation CVE debrief

Who should care

Defenders and developers using Apache OpenNLP versions 3.0.0-M4 and 3.0.0-M5 should assess exposure and prioritize upgrading to 3.0.0-M6 or applying mitigations. This includes operators, platform administrators, vulnerability management teams, and security teams who use or manage Apache OpenNLP deployments.

Why it matters

CVE-2026-67211 is a denial-of-service vulnerability in Apache OpenNLP's SymSpellModelSerializer. An attacker can cause a JVM crash by crafting a malicious .bin model file. Defenders and developers using affected versions should prioritize upgrading or applying mitigations. The impact is limited to DoS, with no evidence of code execution or data theft.

• Denial of Service (DoS) against processes that load SymSpell model files from untrusted or semi-trusted origins
• Potential JVM crash due to OutOfMemoryError
• Need for verification of affected versions and exposure
• Remediation priority for upgrading to 3.0.0-M6 or applying mitigations

Technical summary

The SymSpellModelSerializer.create() method reads two 32-bit signed integer count fields from a binary SymSpell model stream and passes each value directly to LinkedHashMap.newLinkedHashMap() after validating only that it is non-negative. No upper bound is applied, so the count is fully attacker-controlled when the model file originates from an untrusted source. A crafted .bin model file in which either count field is set to Integer.MAX_VALUE (or any value large enough to exhaust the available heap) causes the map to be pre-sized to a capacity of 2^30 entries.

Defensive priority

High

Recommended defensive actions

• Upgrade to Apache OpenNLP version 3.0.0-M6 or later
• Treat all SymSpell .bin model files as untrusted input unless their provenance is verified
• Avoid loading models supplied by end users or fetched from third-party repositories without integrity checks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, affected versions, and mitigation strategies. The SymSpellModelSerializer.create() method reads two 32-bit signed integer count fields from a binary SymSpell model stream and passes each value directly to LinkedHashMap.newLinkedHashMap() after validating only that it is non-negative. No upper bound is applied, so the count is fully attacker-controlled when the model file originates from an untrusted source. A crafted .bin model file in which

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.