CVE-2026-43825

{"id": "CVE-2026-43825", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43825", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-06T19:11:49.058504Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache OpenNLP :: Core :: ML :: LibSVM", "versions": [{"status": "affected", "version": "3.0.0-M1", "lessThan": "3.0.0-M4", "versionType": "semver"}], "packageName": "org.apache.opennlp:opennlp-ml-libsvm", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}]}], "published": "2026-07-06T17:16:31.570", "references": [{"url": "https://lists.apache.org/thread/c7kom0pgk9cbpfnbooh5m3g85ndf50hn", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/06/9", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel\n\nVersions Affected:\n\u00a0 before 3.0.0-M4 (libsvm document categorization module; introduced in\n\u00a0 OPENNLP-1808 and only present on the 3.x line)\n\nDescription:\nSvmDoccatModel.deserialize(InputStream) reads an attacker-controlled\nstream with java.io.ObjectInputStream and calls readObject() without an\nObjectInputFilter installed. ObjectInputStream materialises every class\nreferenced in the stream before the resulting object is cast to\nSvmDoccatModel, so the cast that follows readObject() executes only\nafter the foreign object graph has already been deserialised in full.\n\nIf a Java deserialization gadget chain is available on the consumer's\nclasspath, a crafted payload supplied to\ndeserialize() executes arbitrary code in the JVM that loads it. Apache\nOpenNLP itself does not ship a known gadget chain, so the realistic\nrisk is to downstream applications that embed the libsvm module\nalongside vulnerable transitive dependencies. The method is public and\nstatic, so any caller can pass an untrusted stream to it directly.\n\nThe practical impact is remote code execution against processes that\nload SvmDoccatModel instances from untrusted or semi-trusted origins.\n\nMitigation:\n\n3.x users should upgrade to 3.0.0-M4.\n\nUsers who cannot upgrade immediately should treat all serialized\nSvmDoccatModel streams as untrusted input unless their provenance is\nverified, and should avoid invoking SvmDoccatModel.deserialize() on\nstreams supplied by end users or fetched from third-party sources\nwithout integrity checks."}, {"lang": "es", "value": "Deserializaci\u00f3n Java no confiable en Apache OpenNLP SvmDoccatModel\n\nVersiones Afectadas:\nanteriores a 3.0.0-M4 (m\u00f3dulo de categorizaci\u00f3n de documentos libsvm; introducido en OPENNLP-1808 y solo presente en la l\u00ednea 3.x)\n\nDescripci\u00f3n:\nSvmDoccatModel.deserialize(InputStream) lee un flujo controlado por un atacante con java.io.ObjectInputStream y llama a readObject() sin un ObjectInputFilter instalado. ObjectInputStream materializa cada clase referenciada en el flujo antes de que el objeto resultante sea convertido a SvmDoccatModel, por lo que la conversi\u00f3n que sigue a readObject() se ejecuta solo despu\u00e9s de que el grafo de objetos externo ya haya sido deserializado por completo.\n\nSi una cadena de gadgets de deserializaci\u00f3n Java est\u00e1 disponible en el classpath del consumidor, una carga \u00fatil manipulada suministrada a deserialize() ejecuta c\u00f3digo arbitrario en la JVM que la carga. Apache OpenNLP en s\u00ed mismo no incluye una cadena de gadgets conocida, por lo que el riesgo realista es para las aplicaciones descendentes que incrustan el m\u00f3dulo libsvm junto con dependencias transitivas vulnerables. El m\u00e9todo es p\u00fablico y est\u00e1tico, por lo que cualquier llamador puede pasarle un flujo no confiable directamente.\n\nEl impacto pr\u00e1ctico es la ejecuci\u00f3n remota de c\u00f3digo contra procesos que cargan instancias de SvmDoccatModel desde or\u00edgenes no confiables o semi-confiables.\n\nMitigaci\u00f3n:\n\nLos usuarios de 3.x deber\u00edan actualizar a 3.0.0-M4.\n\nLos usuarios que no puedan actualizar inmediatamente deber\u00edan tratar todos los flujos serializados de SvmDoccatModel como entrada no confiable a menos que se verifique su procedencia, y deber\u00edan evitar invocar SvmDoccatModel.deserialize() en flujos suministrados por usuarios finales u obtenidos de fuentes de terceros sin comprobaciones de integridad."}], "lastModified": "2026-10-25T20:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:opennlp:3.0.0:m1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "57E14048-91DB-4673-9A7B-B15675B3994A"}, {"criteria": "cpe:2.3:a:apache:opennlp:3.0.0:m2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2E738486-C0BD-4FDB-8880-DBC2BA4C0D77"}, {"criteria": "cpe:2.3:a:apache:opennlp:3.0.0:m3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FB9FDE8C-5093-4106-99EA-D1C273B81D21"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}