The vulnerability arises from two built-in regex patterns in Apache OpenNLP's RegexNameFinderFactory: DEFAULT_REGEX_NAME_FINDER.EMAIL and DEFAULT_REGEX_NAME_FINDER.URL. The EMAIL pattern's ambiguous nested quantifiers cause quadratic CPU time growth on inputs with long local-part characters lacking '@'. The URL pattern's nested capturing repetition causes stack overflow errors on inputs with many query tokens, crashing the processing thread. An attacker supplying crafted text to these finders can cause denial of service by exhausting CPU or crashing threads. No special authentication or configuration is needed beyond using these built-in finders. Affected versions are Apache OpenNLP 2.0.0 through 2.5.11 and 3.0.0-M1 through 3.0.0-M5. Upgrading to 2.5.12 or 3.0.0-M6 mitigates the issue.

An attacker able to supply text for analysis to Apache OpenNLP's vulnerable name-finder patterns can cause denial of service by triggering excessive CPU consumption or thread crashes due to stack overflow. This can degrade or halt the embedding application's availability. The vulnerability requires no authentication or special configuration beyond using the affected built-in finders.

Users should upgrade Apache OpenNLP to version 2.5.12 or later, or 3.0.0-M6 or later for the 3.0.0 milestone line, where this issue is fixed. No other mitigation is required as the fix addresses the underlying regex pattern issues.