← Vulnerability feed

Vulnerability record · CVE-2017-12620 · published 3 October 2017

CVE-2017-12620: Apache opennlp xml external entity (xxe) vulnerability

Apache · Opennlp

When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only affects applications that load models or dictionaries from untrusted sources. The versions 1.5.0 to 1.5.3, 1.6.0, 1.7.0 to 1.7.2, 1.8.0 to 1.8.1 of Apache OpenNLP are affected.

9.8 CVSS 3.0 Critical EPSS 3.0% · top 13.0% CWE-611 · XML external entity (XXE)
9.8CVSS 3.0 base score, v2 7.5
3.0%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only affects applications that load models or dictionaries from untrusted sources. The versions 1.5.0 to 1.5.3, 1.6.0, 1.7.0 to 1.7.2, 1.8.0 to 1.8.1 of Apache OpenNLP are affected.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://opennlp.apache.org/news/cve-2017-12620.html ExploitVendor Advisory
http://opennlp.apache.org/news/cve-2017-12620.html ExploitVendor Advisory

Track CVE-2017-12620 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2026-82617Apache opennlp inefficient regular expression (redos) vulnerabilityThe two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULT_REGEX_NAME_FINDER.EMAIL and DEFAULT_REGEX_NA…EPSS 0.77%9.8CVE-2026-42027Apache opennlp deserialization of untrusted data vulnerabilityArbitrary Class Instantiation via Model Manifest in Apache OpenNLP ExtensionLoader Versions Affected: before 1.9.5, before 2.5.9, before 3.0.0-M3 Des…EPSS 1.3%9.1CVE-2026-40682Apache opennlp xml external entity (xxe) vulnerabilityXML External Entity (XXE) via Unsanitized Dictionary Parsing in Apache OpenNLP DictionaryEntryPersistor Versions Affected: before 2.5.9, before 3.0.0…EPSS 0.84%7.5CVE-2026-67211Apache opennlp vulnerabilityOOM Denial of Service via Unbounded Map Pre-Sizing in Apache OpenNLP SymSpellModelSerializer Versions Affected: - 3.0.0-M4 - 3.0.0-M5 (The opennlp-sp…EPSS 0.74%7.5CVE-2026-42440Apache opennlp allocation without limits vulnerabilityOOM Denial of Service via Unbounded Array Allocation in Apache OpenNLP AbstractModelReader  Versions Affected:  before 1.9.5 before 2.5.9 before 3.0.…EPSS 1.1%7.3CVE-2026-43825Apache opennlp deserialization of untrusted data vulnerabilityUntrusted Java Deserialization in Apache OpenNLP SvmDoccatModel Versions Affected:   before 3.0.0-M4 (libsvm document categorization module; introduc…EPSS 14%5.6CVE-2026-63317Apache opennlp vulnerabilityArbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP Versions Affected: - before 2.5.10 - before 3.0.…EPSS 0.85%9.8CVE-2025-58360GeoServer WMS GetMap XXE allows unauthenticated file read and SSRFGeoServer versions 2.26.0 through 2.26.2 and before 2.25.6 accept XML input at the /geoserver/wms GetMap endpoint without sufficiently restricting ex…KEVEPSS 61%analysed

Source: NIST National Vulnerability Database (record CVE-2017-12620), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.