CVE-2017-12620: Apache OpenNLP - Improper Restriction of XML External Entity Reference
Summary
CVE-2017-12620: Improper Restriction of XML External Entity Reference in Apache OpenNLP. Affects org.apache.opennlp:opennlp-tools versions >= 1.5.0, < 1.8.2. Fixed in 1.8.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache OpenNLP is an open-source library used for natural language processing tasks. It provides various tools and models for tasks such as tokenization, part-of-speech tagging, named entity recognition, and more. This vulnerability affects versions 1.5.0 to 1.5.3, 1.6.0, 1.7.0 to 1.7.2, and 1.8.0 to 1.8.1 of Apache OpenNLP. The vulnerability arises when loading models or dictionaries that contain XML, allowing for an XML External Entity (XXE) attack. However, it is important to note that this vulnerability only affects applications that load models or dictionaries from untrusted sources.
Vulnerability Detail
The vulnerability in Apache OpenNLP allows an attacker to perform an XXE attack by exploiting the improper restriction of XML external entity references. By loading malicious XML files, an attacker can potentially access sensitive information, perform denial-of-service attacks, or execute arbitrary code. This vulnerability poses a critical risk to applications that utilize Apache OpenNLP and load models or dictionaries from untrusted sources.
How To Fix
Latest published version: 3.0.0-M6 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.8.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, as a general best practice, it is recommended to always load models or dictionaries from trusted sources. Implement proper input validation and sanitization techniques to prevent the inclusion of malicious XML files. Regularly update your dependencies to the latest versions to benefit from security patches and fixes.
Conclusion
The vulnerability in Apache OpenNLP allows for an XML External Entity (XXE) attack when loading models or dictionaries from untrusted sources. To mitigate this risk, it is crucial to upgrade to Apache OpenNLP version 1.8.2 or later, ensure trusted sources for loading models or dictionaries, and implement proper input validation. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.apache.opennlp:opennlp-tools →
FAQ
The vulnerability affects versions 1.5.0 to 1.5.3, 1.6.0, 1.7.0 to 1.7.2, and 1.8.0 to 1.8.1 of Apache OpenNLP.
An XML External Entity (XXE) attack is a type of attack where an attacker exploits the ability to include external entities in an XML document. By including malicious external entities, an attacker can read sensitive files, perform denial-of-service attacks, or execute arbitrary code.
To mitigate the risk of this vulnerability, ensure that you are using Apache OpenNLP version 1.8.2 or later. Additionally, only load models or dictionaries from trusted sources and implement proper input validation and sanitization techniques.
No, only applications that load models or dictionaries from untrusted sources are affected by this vulnerability. If your application does not load such resources or only loads them from trusted sources, it is not vulnerable to this specific issue.
Yes, upgrading to Apache OpenNLP version 1.8.2 or later fixes this vulnerability. Ensure that you update the Apache OpenNLP dependency in your project's pom.xml file and rebuild your application.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.opennlp:opennlp-tools.
