CVE-2026-43825: Apache OpenNLP SvmDoccatModel unsafe deserialization

Apache OpenNLP 3.x before 3.0.0-M4 contains an unsafe Java deserialization vulnerability in SvmDoccatModel.deserialize(InputStream) within the opennlp-ml-libsvm module. The method creates a java.io.ObjectInputStream and calls readObject() on an attacker-supplied byte stream without installing an ObjectInputFilter. Because ObjectInputStream.readObject() materialises every class referenced in the stream before the result is cast to SvmDoccatModel, any gadget class available on the consumer's classpath can execute arbitrary code during deserialization — before the caller ever inspects the returned object.

• Package/component affected: org.apache.opennlp:opennlp-ml-libsvm — class opennlp.tools.ml.libsvm.doccat.SvmDoccatModel
• Affected versions: Apache OpenNLP 3.x before 3.0.0-M4 (the libsvm document categorization module was introduced via OPENNLP-1808 and exists only on the 3.x line)
• Fixed in: 3.0.0-M4 (commit 3cf42d4a0145cefd9dd06138873a91312052c767, PR #1029, OPENNLP-1823)
• Risk level: High (CVSSv3 7.3 per Red Hat advisory)
• Consequences: Remote code execution in any JVM process that loads SvmDoccatModel instances from untrusted or semi-trusted sources. The method is public static, so any caller can pass an untrusted stream directly. Apache OpenNLP itself does not ship a known gadget chain, so the realistic risk is to downstream applications that embed the libsvm module alongside vulnerable transitive dependencies (e.g., CommonsCollections, Groovy, Spring).

Impact Parity

• Disclosed/claimed maximum impact: Code execution — arbitrary code execution via a crafted serialized stream when a gadget chain is present on the classpath.
• Reproduced impact from this run: Code execution — a custom MaliciousGadget class (implementing Serializable with a readObject() side-effect) was placed on the classpath and its readObject() method executed during SvmDoccatModel.deserialize(), writing a marker file as proof of arbitrary code execution. The cast to SvmDoccatModel threw ClassCastException only AFTER the gadget code had already run.
• Parity: full — the proof demonstrates the exact mechanism described in the advisory: ObjectInputStream.readObject() materialises foreign objects before the cast, allowing arbitrary code execution during deserialization.
• Not demonstrated: A real-world gadget chain (e.g., CommonsCollections) was not used; instead, a purpose-built gadget class simulated the same mechanism. This is appropriate because the CVE explicitly states "Apache OpenNLP itself does not ship a known gadget chain."

Root Cause

The vulnerable deserialize method in SvmDoccatModel.java (before 3.0.0-M4) is:

public static SvmDoccatModel deserialize(InputStream in) throws IOException, ClassNotFoundException {
    try (ObjectInputStream ois = new ObjectInputStream(in)) {
      return (SvmDoccatModel) ois.readObject();
    }
}

No ObjectInputFilter is installed. Java's ObjectInputStream.readObject() resolves and instantiates every class descriptor in the serialized stream, invoking each class's readObject(), readResolve(), or other deserialization hooks as part of the process. The cast to SvmDoccatModel occurs only AFTER the entire object graph has been deserialised. This means:

1. An attacker crafts a serialized byte stream containing a gadget class (any Serializable class with a dangerous readObject() method).
2. The stream is passed to SvmDoccatModel.deserialize().
3. ObjectInputStream.readObject() encounters the gadget class, loads it from the classpath, and invokes its readObject() method — arbitrary code executes.
4. Only then does the cast (SvmDoccatModel) fail with ClassCastException — but the damage is already done.

Fix (commit 3cf42d4a): The fix adds an ObjectInputFilter via ois.setObjectInputFilter(buildFilter(limits)) before readObject(). The filter:

• Allow-lists only the specific classes that can legitimately appear in a SvmDoccatModel serialization graph (OpenNLP types, zlibsvm domain types, libsvm structures, and a minimal set of JDK types).
• Bounds graph depth (64), references (5,000,000), and array length (10,000,000).
• Rejects any class not on the allow-list with ObjectInputFilter.Status.REJECTED, causing readObject() to throw InvalidClassException BEFORE the foreign class is materialised.

Fix commit: 3cf42d4a0145cefd9dd06138873a91312052c767 Fix PR: https://github.com/apache/opennlp/pull/1029 (OPENNLP-1823)

Reproduction Steps

1. Script: bundle/repro/reproduction_steps.sh
2. What the script does:
   • Installs JDK 21 and Maven (required by OpenNLP 3.x).
   • Clones the Apache OpenNLP repository (or reuses the project cache).
   • Checks out and builds the vulnerable commit (3cb7232e) — the parent of the fix — which has no ObjectInputFilter.
   • Compiles a MaliciousGadget class (a Serializable class whose readObject() writes a marker file) and a Poc harness that serializes the gadget and feeds the bytes to SvmDoccatModel.deserialize().
   • Runs the PoC against the vulnerable build: the gadget's readObject() executes, a marker file is created, and ClassCastException is thrown after execution.
   • Checks out and builds the fixed commit (3cf42d4a) which adds ObjectInputFilter.
   • Runs the same PoC against the fixed build: InvalidClassException is thrown by the filter, no code executes, no marker file is created.
   • Writes runtime_manifest.json with proof artifacts and exits 0 if the vulnerability is confirmed.
3. Expected evidence:
   • bundle/logs/poc_vulnerable.log — shows [GADGET EXECUTED] and CODE EXECUTION CONFIRMED with exit code 10.
   • bundle/logs/gadget_executed_vulnerable.txt — the marker file written by the gadget's readObject().
   • bundle/logs/poc_fixed.log — shows ObjectInputFilter rejected foreign class with InvalidClassException and exit code 20.

Evidence

Vulnerable version PoC output (bundle/logs/poc_vulnerable.log):

[*] Calling SvmDoccatModel.deserialize() with malicious stream...
[GADGET EXECUTED] Arbitrary code ran during deserialization: id;whoami;uname -a
[GADGET EXECUTED] Marker file written to: /tmp/opennlp_poc_marker_vuln.txt
[!] VULNERABLE version: readObject() completed, cast failed AFTER
[!] Exception: java.lang.ClassCastException: class MaliciousGadget cannot be cast to class opennlp.tools.ml.libsvm.doccat.SvmDoccatModel
[!!!] CODE EXECUTION CONFIRMED: gadget readObject() ran!

Gadget marker file (bundle/logs/gadget_executed_vulnerable.txt):

DESERIALIZATION_GADGET_EXECUTED: id;whoami;uname -a
Thread: main
Time: 2026-07-09T18:16:03.331869217Z
Class: MaliciousGadget

Fixed version PoC output (bundle/logs/poc_fixed.log):

[*] Calling SvmDoccatModel.deserialize() with malicious stream...
[+] FIXED version: ObjectInputFilter rejected foreign class
[+] Exception: java.io.InvalidClassException: filter status: REJECTED
[*] No marker file found — gadget code did NOT execute
VERDICT: FIXED — ObjectInputFilter blocked the foreign class

Source verification:

• Vulnerable SvmDoccatModel.java: 0 references to ObjectInputFilter (confirmed via grep -c).
• Fixed SvmDoccatModel.java: 11 references to ObjectInputFilter (confirmed via grep -c).

Environment:

• JDK: OpenJDK 21.0.11
• Maven: 3.9.12
• OS: Ubuntu 26.04 (Linux)
• Vulnerable commit: 3cb7232ecaccc788e32bf76b7c031fb166840da5
• Fixed commit: 3cf42d4a0145cefd9dd06138873a91312052c767

Recommendations / Next Steps

• Upgrade: Users on OpenNLP 3.x before 3.0.0-M4 should upgrade to 3.0.0-M4 immediately.
• Defense in depth: Even with the ObjectInputFilter, callers should treat serialized SvmDoccatModel streams as untrusted input and verify their provenance before deserialization. The filter is defense-in-depth, not a license to deserialize from untrusted sources.
• Input validation: Applications that accept model files from end users or third-party sources should add integrity checks (e.g., signatures, checksums) before calling deserialize().
• Classpath hygiene: Remove unnecessary gadget-chain-capable libraries from the classpath of any process that deserializes OpenNLP models.
• Testing: The fix includes test cases (SvmDoccatModelTest.java) that verify foreign classes are rejected. Downstream applications should add integration tests that feed crafted streams to deserialize() and verify rejection.

Additional Notes

• Idempotency: The script was run twice consecutively; both runs produced identical results (exit code 0, vulnerable exit 10, fixed exit 20).
• Gadget class: The MaliciousGadget class is a purpose-built simulation of a real deserialization gadget. In a real attack, a class from a vulnerable transitive dependency (e.g., org.apache.commons.collections.functors.InvokerTransformer) would serve the same role. The proof demonstrates the deserialization mechanism, not a specific real-world gadget chain.
• Scope: The vulnerability is in the opennlp-ml-libsvm module only. Other OpenNLP modules use different serialization mechanisms (e.g., the main DoccatModel uses a custom binary format, not Java object serialization).
• Limitation: The MaliciousGadget class must be on the classpath for the exploit to work, which mirrors the real-world constraint that a gadget-chain-capable library must be present. The CVE description explicitly acknowledges this.