Apache OpenNLP 2.5.12 released

The Apache OpenNLP team is pleased to announce the release of Apache OpenNLP 2.5.12.

The Apache OpenNLP library is a machine learning based toolkit for the processing of natural language text.

It supports the most common NLP tasks, such as tokenization, sentence segmentation, part-of-speech tagging, named entity extraction, chunking, parsing, and coreference resolution.

Apache OpenNLP 2.5.12 binary and source distributions are available for download from our download page.

The OpenNLP library is distributed by Maven Central as well. See the Maven dependency page for more details.

What’s new in Apache OpenNLP 2.5.12

This is a maintenance release on the 2.x line. It contains a security fix, bug fixes, performance improvements, and dependency updates.

Security Fixes

One security issue is addressed in this release.

ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns (OPENNLP-1922, CVE-2026-82617)

The built-in EMAIL and URL patterns of RegexNameFinderFactory (DEFAULT_REGEX_NAME_FINDER) contained ambiguous nested quantifiers. Applications applying these finders to untrusted text could be driven into super-linear backtracking (EMAIL) or unbounded matcher recursion ending in a StackOverflowError (URL) by a small crafted input, denying service to the embedding application. Users of the built-in finders are recommended to upgrade.

Improvements

Cached models are now verified against their SHA-512 checksum (OPENNLP-1902)
BeamSearch now uses chain nodes instead of per-candidate Sequence copies (OPENNLP-1903)
The sentence detector abbreviation veto is no longer quadratic in document length (OPENNLP-1906)
The source distribution now includes the Maven Wrapper config (OPENNLP-1896, OPENNLP-1913)

Bug fixes

Default-locale case folding no longer corrupts lemmatizer models and output (OPENNLP-1904)
Default-locale case folding no longer breaks Morfologik dictionary lookup (OPENNLP-1905)
Fixed broken line encoding for mwnd.cmd (OPENNLP-1915)

Dependency Updates

Update ONNX runtime to 1.28.0 (OPENNLP-1908)
Update classgraph to 4.8.194 (OPENNLP-1907)
Update Maven Wrapper to 3.3.4 (OPENNLP-1914)
Update logcaptor to 2.12.7 (OPENNLP-1923)

For further details, check the full list of changes via the project’s issue tracker.

--The Apache OpenNLP Team