Loading story…
Apache disclosed CVE-2026-82617, a CVSS 4.0 10.0 critical denial-of-service flaw in OpenNLP's built-in EMAIL and URL regular-expression name finders exposed through RegexNameFinderFactory. Applications that process attacker-controlled text with the default finders can be affected without authentication or other special prerequisites.
Crafted email-like input lacking a terminating @ triggers super-linear, approximately quadratic regex backtracking that can consume CPU for seconds or minutes. URL query strings containing many ampersand-separated tokens can cause unbounded Java matcher recursion, raising an uncaught java.lang.StackOverflowError and terminating the calling thread. Apache OpenNLP opennlp-tools 2.0.0 through 2.5.11 and opennlp-core 3.0.0-M1 through 3.0.0-M5 are affected; organizations should upgrade to 2.5.12 or 3.0.0-M6.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-82617 was published for a denial-of-service flaw in Apache OpenNLP's built-in EMAIL and URL RegexNameFinderFactory patterns. Crafted input can cause quadratic regex backtracking or Java StackOverflowError; versions 2.0.0 through 2.5.11 and 3.0.0-M1 through 3.0.0-M5 are affected, with fixes in 2.5.12 and 3.0.0-M6.
A Nessus Unix-agent plugin identified CVE-2026-82617 as unpatched on Debian Linux 12.0, 13.0, and 14.0. The plugin reported no known public exploits and assessed the flaw as network-accessible with high availability impact.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
tenable.com
Open sourcelists.apache.org
Open sourcecve.org
Open sourceopenwall.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache disclosed **CVE-2026-63317**, a moderate-severity vulnerability in **Apache OpenNLP** that allows arbitrary class instantiation through multiple unvalidated extension-loading paths. The issue affects code paths that call `Class.forName()` and invoke a no-argument constructor without verifying the supplied class name or type, including model loading through XML feature generator descriptors in `GeneratorFactory`, untrusted format names handled by `StreamFactoryRegistry`, and the `opennlp.interner.class` system property. Apache said exploitation depends on an attacker-useful class already being present on the application classpath and having side effects in its static initializer or constructor, making the flaw more constrained than typical remote code execution. The project fixed the issue by moving extension loading to an allowlist-based **ExtensionLoader** mechanism, and advised users to upgrade to patched releases and ensure model files, XML feature descriptors, and format names are accepted only from trusted sources.
Jul 24, 2026
A critical flaw in Bouncy Castle Java certificate validation, tracked as **CVE-2026-8763**, allows attackers to bypass **Name Constraints** checks by appending a trailing dot to `rfc822Name` and `URI` values in certificates. The bug affects **Bouncy Castle for Java** before `1.85`, **BC-LTS** before `2.73.12`, and **Bouncy Castle FIPS (BC-FJA)** before `1.0.2.7`, `2.0.2`, and `2.1.3`, and carries a **CVSS 4.0 score of 9.3**. The weakness is classified as **CWE-295: Improper Certificate Validation** and is considered remotely exploitable without privileges or user interaction. Project maintainers said the issue stems from inconsistent handling of trailing dots in `PKIXNameConstraintValidator`: `dNSName` values were normalized for comparison, but `rfc822Name` and `URI` values were not, enabling excluded subtree checks to be evaded. An attacker controlling a name-constrained intermediate CA could issue certificates for email addresses or URI hosts that policy should have blocked. The vulnerable path is reachable through the Java 8+ PKIX certificate validation flow, and fixes were released in the patched versions above, including commit `2c28b253a446`.
Aug 5, 2026
Security researchers detailed multiple ways applications can be tricked into accepting malicious URLs when validation relies on weak regular expressions or unsafe handling of non-ASCII hostnames. Common flaws include missing `^` or `$` anchors, unescaped dots, multiline matching, overly broad scheme checks, and denylist-style filters for user-controlled subdomains such as `*.example.jp`. The reported impact includes **open redirect**, access-control bypass, and **XSS**, with additional edge cases involving `userinfo`, protocol-relative URLs, and parser discrepancies between browsers and language libraries, especially around backslashes. A separate analysis showed that multibyte and invalid non-ASCII characters can also subvert redirect and link validation by causing downstream components to emit `?` inside the hostname, changing how a trusted-looking domain is interpreted. The behavior was observed across legacy Java, Tomcat, ASP.NET, PHP, and some tooling, while newer Java and Tomcat versions mitigated parts of the issue; Burp Suite was also noted as a source of false positives in some HTTP/2 proxy scenarios. Researchers recommended strict allowlist validation, fixed `https` handling, parser-based host verification, rejection of non-ASCII subdomains unless safely converted with **Punycode** and `STD3ASCIIRules`, URL-encoding before redirects, and testing regexes for **ReDoS** with input length limits.
Aug 15, 2026