CVE-2026-42440: Apache OpenNLP AbstractModelReader out-of-memory via unbounded array allocation

Summary

CVE-2026-42440 is an out-of-memory denial-of-service flaw in Apache OpenNLP's AbstractModelReader, affecting versions before 2.5.9 and before 3.0.0-M3. The methods getOutcomes(), getOutcomePatterns() and getPredicates() allocate arrays using an unvalidated 32-bit count read from a binary model stream. A crafted .bin model file can set that count to Integer.MAX_VALUE, causing an OutOfMemoryError before the label or pattern data is read, so a single small file can crash any JVM that loads it.

Mitigation

2.x users should upgrade to 2.5.9. 3.x users should upgrade to 3.0.0-M3. Users who cannot upgrade immediately should treat all .bin model files as untrusted input unless their provenance is verified, and avoid loading models supplied by end users or fetched from third-party repositories without integrity checks.

Related items

• HighCVE-2026-123356: GROBID unauthenticated thread exhaustion through /api/modelTraining endpointSimilar attack · NVD/CVE Database
• MediumCVE-2026-83494: training-operator immutability check bypass in PyTorchJob ValidateUpdate webhookSimilar attack · NVD/CVE Database
• CriticalCVE-2026-48705: MONAI PydicomReader affine computation accepts non-finite DICOM valuesSimilar attack · NVD/CVE Database
• LowCloakFEM: Agentic FEM Code Generation for Red-Teaming Computational Resource ExhaustionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumThe Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model ResourcesSimilar attack · Google Threat Intelligence