The vulnerability (CVE-2026-43825) affects Apache OpenNLP's libsvm document categorization module prior to version 3.0.0-M4. The SvmDoccatModel.deserialize(InputStream) method uses java.io.ObjectInputStream to deserialize data from an attacker-controlled stream without an ObjectInputFilter, allowing deserialization of arbitrary objects. Since the deserialization occurs before the cast to SvmDoccatModel, any malicious object graph can be fully materialized. If a Java deserialization gadget chain is present in the application's classpath, this can lead to remote code execution. Apache OpenNLP itself does not include known gadget chains, so the primary risk is to downstream applications embedding this module with vulnerable dependencies. The method is public and static, enabling any caller to pass untrusted streams directly.

The vulnerability enables remote code execution in JVM processes that deserialize SvmDoccatModel instances from untrusted or semi-trusted sources. This can compromise the confidentiality, integrity, and availability of affected systems. The risk depends on the presence of exploitable gadget chains in the runtime environment, which Apache OpenNLP does not provide by default. Therefore, the impact is primarily on downstream applications that include vulnerable transitive dependencies alongside the libsvm module.

Users of Apache OpenNLP 3.x should upgrade to version 3.0.0-M4, which addresses this vulnerability. For those unable to upgrade immediately, it is critical to treat all serialized SvmDoccatModel streams as untrusted unless their provenance is verified. Avoid calling SvmDoccatModel.deserialize() on streams from end users or third-party sources without integrity checks. No official patch or fix advisory is provided in the input data; therefore, patch status is not yet confirmed — check the vendor advisory for current remediation guidance.