LoginSign Up
← Back to all sparks
A

Apache OpenNLP

DEVOPS
Velocity5.0

Machine learning toolkit for natural language text processing

opennlp.apache.org ↗

Three parallel lines, one shared job: making model files safe to load

nlpapachemodel-supply-chainonnxtokenizationsecurity-hardening
◆Current state
OpenNLP maintains three branches at once — a 1.9.x line kept alive because Lucene and Solr 8.x depend on it, a 2.5.x production line, and a 3.0.0 milestone series. Recent releases across all three are driven by the same security work: XXE in the dictionary parser, arbitrary class instantiation via crafted model archives, untrusted Java deserialization in SvmDoccatModel, and OOM-by-array-allocation. Alongside that, the 3.0 milestones are quietly rebuilding the text-processing core.
◆Where it's heading
Two arcs run in parallel. The defensive one treats model archives as untrusted input — an allowlist before Class.forName, ObjectInputFilter on deserialization, secure XML processing — which is the right posture now that models are distributed artifacts. The constructive one, concentrated in 3.0.0-M4 and M5, layers in a UAX#29 word tokenizer, a Unicode normalization and confusables engine, an offset/alignment layer, and ONNX-hosted transformer models including RoBERTa.
◆Prediction
The 3.0 milestone series looks close to feature-complete on the tokenization and normalization stack, so the next milestones should shift toward stabilization ahead of a 3.0.0 release while 2.5.x keeps receiving backported fixes.

◆Recent moves

  1. 17d ago

    3.0.0-M5 adds a UAX#29 tokenizer and Unicode normalization engine

    The largest constructive milestone yet on the 3.x line: a standards-based UAX#29 word tokenizer, a Unicode normalization engine handling character classes and confusables, an offset and alignment layer, a layered Term model, and a per-language normalization profile registry. This is the new text-processing foundation 3.0 is being built on.

    View source ↗
  2. 17d ago

    1.9.5 backports security fixes for Lucene and Solr 8.x users

    A maintenance release on a line that would otherwise be dead, kept alive specifically because Lucene 8.x and Solr 8.x still depend on OpenNLP 1.9.x. Carries the same allowlisted ExtensionLoader, XML parser hardening, and OOM prevention shipped upstream.

    View source ↗
  3. 17d ago

    2.5.10 brings RoBERTa models to the 2.x line via ONNX

    Adds support for using RoBERTa-based models through ONNX on the production branch, plus fixes for native memory leaks and vocabulary NPEs in both DocumentCategorizerDL and NameFinderDL. The transformer path is no longer milestone-only, and the leak fixes make it viable in long-running processes.

    View source ↗
  4. 17d ago

    OpenNLP 2.5.11

    Almost entirely dependency and GitHub Actions bumps backported to the 2.x branch, plus resolving a DocBook DTD from a local catalog instead of a remote URL. No user-facing NLP change.

    View source ↗
  5. 1mo ago

    3.0.0-M4 fixes a deserialization CVE and adds a SymSpell spell checker

    Closes CVE-2026-43825, an untrusted Java deserialization path in SvmDoccatModel, by hardening deserialize() with an ObjectInputFilter and resource limits. Also adds a SymSpell-based SpellChecker component and bundled stop-word lists — the same release doing defensive and constructive work.

    View source ↗
  6. 3mo ago

    2.5.9 backports three model-loading security fixes

    Backports the 3.0.0-M3 security set to the production line: XXE in DictionaryEntryPersistor enabling local file disclosure or SSRF, arbitrary class instantiation where ExtensionLoader ran a class's static initializer before its type check, and unbounded array allocation. The ExtensionLoader fix introduces a package-prefix allowlist.

    View source ↗