CVE-2026-42027
CriticalAdvisory
Published 4 May 2026In the index since 6 Sept 2026
- Severity
- Critical
- worst across findings
- CVSS
- 9.8
- base score, highest
- EPSS
- 0.007
- 51st percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 11
- of 17,781 indexed, latest versions
- Container images
- 11
- deployed by those charts
- Fix available
- 1 of 1
- affected package
Apache OpenNLP ExtensionLoader Vulnerable to Arbitrary Class Instantiation via Model Manifest
Carried by container images the latest versions of 11 of 17,781 indexed charts deploy, on 11 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| opennlp-toolsmaven | 1.9.2, 1.9.4, 2.4.0, 2.5.4+1 more | 1.9.5, 2.5.9 | 11 |
- OSV records
- GHSA-cx4m-2p55-rw7j
Charts affected
11 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| solrpreferred-aiVerified publisher | 3.2.0 | 1 of 3See more | 6,048 |
| thingsboardcetic | 0.1.2 | 1 of 2See more | 5,235 |
| ckanstatcan | 0.0.35 | 1 of 8See more | 24,930 |
| tocktock | 0.6.3 | 3 of 9See more | 12,907 |
| ckanhelmforgeVerified publisher | 1.3.8 | 1 of 6See more | 9,920 |
| xwikikeyporttech | 0.2.0 | 1 of 2See more | 1,595 |
| onyx-stackonyx | 0.3.1 | 1 of 12See more | 6,338 |
| fdi-dotstatsuite-sfs-solrstatcan | 1.0.2 | 1 of 4See more | 6,065 |
| solrstatcan | 1.5.10 | 1 of 3See more | 8,806 |
| languagetool-serverszpadel-chartsVerified publisher | 0.4.0 | 1 of 1See more | 808 |
| language-toolzekker6Verified publisher | 1.12.1 | 1 of 2See more | 1,571 |
Container images carrying it
11 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| library/ | 8c5f7881cebb | opennlp-tools | 1.9.5 | 3 |
| ckan/ | ef8e5d3e6be1 | opennlp-tools | 1.9.5 | 1 |
| erikvl87/ | e1ea6a975388 | opennlp-tools | 1.9.5 | 1 |
| library/ | d124efd81fbb | opennlp-tools | 1.9.5 | 1 |
| library/ | 56490ac14a31 | opennlp-tools | 1.9.5 | 1 |
| thingsboard/ | 2d17e4e36edc | opennlp-tools | 2.5.9 | 1 |
| tock/ | df3e38c77a38 | opennlp-tools | 2.5.9 | 1 |
| tock/ | 080cb6b08d5b | opennlp-tools | 2.5.9 | 1 |
| tock/ | c04ffe67b977 | opennlp-tools | 2.5.9 | 1 |
| vespaengine/ | 69b160f58211 | opennlp-tools | 2.5.9 | 1 |
| ghcr.io/ | 68fdab22b2a9 | opennlp-tools | 1.9.5 | 1 |