The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULT_REGEX_NAME_FINDER.EMAIL and DEFAULT_REGEX_NAME_FINDER.URL - contain ambiguous nested quantifie…

Critical CVSS 9.8

CVECVE-2026-82617

First seen2026-09-16 15:16 UTC

Disclosed2026-09-11 18:16 UTC

Last updated2026-09-16 15:16 UTC

Channel statusauto

Summary

The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULT_REGEX_NAME_FINDER.EMAIL and DEFAULT_REGEX_NAME_FINDER.URL - contain ambiguous nested quantifiers. An application that obtains these finders through RegexNameFinderFactory.getDefaultRegexNameFinders(...) and then applies them to untrusted text through RegexNameFinder.find(String[]) or RegexNameFinder.find(String) can be driven into super-linear backtracking or into unbounded matcher recursion…

In-depth triage

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Affected products

Sources

NVD DATABASE

Original Links

https://lists.apache.org/thread/spzhcxxszqdpppg70m1zz2l3mv29mhl3 Mailing List
http://www.openwall.com/lists/oss-security/2026/09/11/10 Mailing List

Timeline

2026-09-16 nvd_ingest NVD