CVE-2026-82617

/// Technical description

The two built-in name-finder patterns exposed by

opennlp.tools.namefind.RegexNameFinderFactory - DEFAULT_REGEX_NAME_FINDER.EMAIL

and DEFAULT_REGEX_NAME_FINDER.URL - contain ambiguous nested quantifiers. An

application that obtains these finders through

RegexNameFinderFactory.getDefaultRegexNameFinders(...) and then applies them to

untrusted text through RegexNameFinder.find(String[]) or RegexNameFinder.find(String)

can be driven into super-linear backtracking or into unbounded matcher recursion by a

small crafted input.

For the EMAIL pattern, a long run of local-part characters that is never followed by an

@ forces the matcher to re-scan to end-of-input from every starting offset. Cost grows

quadratically with input length: an input of approximately 32 KB consumes several seconds

of CPU in a single find() call and returns no match, and each doubling of the input

multiplies the cost roughly four-fold.

For the URL pattern, the query-string sub-expression nests a capturing repet

/// Remediation

Check the references section for vendor advisories and patches from apache. Update opennlp to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// Affected products

/// References