Threats affecting pkg:maven/Apache Software Foundation/org.apache.opennlp:opennlp-core

CVE-2026-82617 is a critical vulnerability in Apache OpenNLP affecting versions from 2.0.0 through 2.5.11 and 3.0.0-M1 through 3.0.0-M5. It involves two built-in name-finder regex patterns for EMAIL and URL that contain ambiguous nested quantifiers. These patterns can cause super-linear backtracking or unbounded recursion when processing crafted inputs, leading to high CPU usage or thread crashes. The vulnerability allows denial of service without requiring authentication or special configuration. Fixed versions 2.5.12 and 3.0.0-M6 address this issue.