Improper Restriction of XML External Entity Reference in Apache OpenNLP

CRITICAL 9.8CVE-2017-12620 · GHSA-h22x-hm8g-rxpg · Published 03/10/2017 · updated 17/06/2026

In short

CVE-2017-12620 is a CRITICAL (CVSS 9.8) vulnerability affecting org.apache.opennlp:opennlp-tools, opennlp (apache).
Chance of exploitation in the next 30 days (EPSS): 3.0%, higher than 87.5% of all vulnerabilities.
Fix: update to 1.8.2 or later.

Package	Affected versions	Patched versions
org.apache.opennlp:opennlp-tools Maven	`≥ 1.5.0, < 1.8.2`	`1.8.2`
opennlp apache	`= 1.5.0= 1.5.1= 1.5.2= 1.5.3= 1.6.0= 1.7.0= 1.7.1= 1.7.2= 1.8.0= 1.8.1`	No fix yet

Description

When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only affects applications that load models or dictionaries from untrusted sources. The versions 1.5.0 to 1.5.3, 1.6.0, 1.7.0 to 1.7.2, 1.8.0 to 1.8.1 of Apache OpenNLP are affected.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2017-12620 · ADVISORY
opennlp.apache.org/news/cve-2017-12620.html · WEB

More vulnerabilities in org.apache.opennlp:opennlp-tools

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.apache.opennlp:opennlp-tools

Maven

≥ 1.5.0, < 1.8.2

1.8.2

opennlp

apache

= 1.5.0= 1.5.1= 1.5.2= 1.5.3= 1.6.0= 1.7.0= 1.7.1= 1.7.2= 1.8.0= 1.8.1

No fix yet

Description

NVD description

More vulnerabilities in org.apache.opennlp:opennlp-tools

See all →