THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-42027 (CRITICAL 9.8) — Arbitrary Class Instantiation via Model Manifest in Apache OpenNLP ExtensionLoader Versions Affected: before 1.9.5, before 2.5.9, before 3.0.0-M3 Description: The ExtensionLoader.instantiateExtension(Class, String) method loads a class by its fully-qualified name via

[NVD] CVE-2026-42027 (CRITICAL 9.8) — Arbitrary Class Instantiation via Model Manifest in Apache OpenNLP ExtensionLoader Versions Affected: before 1.9.5, before 2.5.9, before 3.0.0-M3 Description: The ExtensionLoader.instantiateExtension(Class, String) method loads a class by its fully-qualified name via

lownvdPublished 2026-05-04

CVE-2026-42027 CVSS: 9.8 CRITICAL Published: 2026-05-04T17:16:24.123

Arbitrary Class Instantiation via Model Manifest in Apache OpenNLP ExtensionLoader

Versions Affected: before 1.9.5, before 2.5.9, before 3.0.0-M3

Description:

The ExtensionLoader.instantiateExtension(Class, String) method loads a class by its fully-qualified name via Class.forName() and invokes its no-arg constructor

Indicators of compromise

CVE-2026-42027cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-42027