Threats affecting pkg:maven/Apache Software Foundation/org.apache.opennlp:opennlp-symspell

CVE-2026-67211 is a high-severity denial of service vulnerability in Apache OpenNLP versions 3.0.0-M4 and 3.0.0-M5. It arises from unbounded memory allocation when deserializing SymSpell model files with attacker-controlled size fields, leading to OutOfMemoryError and process crashes. The issue affects the SymSpellModelSerializer.create() method and all code paths that load SymSpell models from untrusted sources. The vulnerability is fixed in version 3.0.0-M6 by enforcing an upper bound on the size fields to prevent excessive memory allocation.