Apache OpenNLP EUVD-2026-27003

Requires attacker ability to supply a crafted XML dictionary file to the Dictionary(InputStream) constructor. This condition is met when: (1) applications expose dictionary upload functionality to untrusted users via web forms, REST APIs, or file-processing pipelines; (2) systems load dictionaries from user-controlled directories, network shares, or third-party repositories without integrity verification; or (3) NLP workflows accept serialized Dictionary objects from untrusted sources. Default OpenNLP usage with embedded dictionaries from the opennlp-models JAR is NOT vulnerable as those resources are static and trusted. Exploitation is LIMITED by: no requirement for valid dictionary content structure (XXE triggers during SAX initialization before semantic validation), network reachability from server to attacker-controlled endpoints for SSRF payloads, and file-system permissions for file:// disclosure. Authentication, non-default configuration, and user interaction are NOT required per CVSS vector AV:N/AC:L/PR:N/UI:N.

CVSS 9.1 (AV:N/AC:L/PR:N/UI:N) indicates maximum exploitability: network-accessible, low complexity, no authentication or user interaction required. However, EPSS exploitation probability of 0.03% (8th percentile) suggests minimal observed attacker interest. No CISA KEV listing confirms no active exploitation campaigns. No public POC identified at time of analysis. Real-world risk depends heavily on deployment context: applications accepting dictionary files from untrusted sources (web uploads, third-party integrations) face genuine SSRF and file disclosure risk, while systems using only embedded or administrator-controlled dictionaries have minimal exposure. The inconsistency with XmlUtil.createSaxParser() indicates this is a localized implementation oversight rather than systemic architecture flaw. SSVC factors: Exploitation status = none, Automatable = yes (once attacker controls dictionary input), Technical Impact = partial (confidentiality + integrity via SSRF, no availability impact per CVSS:A:N). Priority for patching should be HIGH for internet-facing NLP services processing user-supplied dictionaries, MEDIUM for internal/trusted-input deployments. The Apache Software Foundation's prompt patch release and detailed advisory increase confidence in remediation path.

Attacker identifies an NLP-powered web service allowing users to upload custom stop-word dictionaries for text classification. They craft a malicious XML dictionary file containing a DOCTYPE declaration with file:// entity reference to /etc/passwd or http:// reference to internal metadata service (169.254.169.254). When the service invokes new Dictionary(maliciousInputStream) to load the dictionary, the SAX parser resolves external entities before processing entries, returning file contents in parser error messages or triggering SSRF requests observable via callback server. Public exploit code exists for generic XXE attacks in Java SAX parsers; adaptation to OpenNLP's Dictionary API requires only supplying the DOCTYPE-laden XML to the documented constructor.