CVE-2026-42027
CVE-2026-42027: 2 tracked advisory records across Apache, Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Apache
1 advisory- Advisory severityCritical9.8
Critical [CVE-2026-42027] Apache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoader
CVE-2026-42027Source published Source updated
Arbitrary Class Instantiation via Model Manifest in Apache OpenNLP ExtensionLoader Versions Affected: before 1.9.5, before 2.5.9, before 3.0.0-M3 The ExtensionLoader.instantiateExtension(Class, String) method loads a class by its fully-qualified name via Class.forName() and invokes its no-arg constructor, with the class name sourced from the manifest.properties entry of a model archive. The existing isAssignableFrom check correctly rejects classes that are not subtypes of the expected extension interface (BaseToolFactory for factory=, ArtifactSerializer for serializer-class-*), but the check runs after Class.forName() has already loaded and initialized the named class. Class.forName() with default initialization semantics executes the target class's static initializer before returning…
- Affected products in this advisory
- Apache OpenNLP ExtensionLoader
- Source-reported affected versions
- Apache OpenNLP 2.0 before 2.5.9
- Apache OpenNLP 3.0.0-M1 before 3.0.0-M3
- Apache OpenNLP before 1.9.5
- Source-reported fixed versions
- 2.5.9
- 3.0.0-M3
- 1.9.5
- Mitigation guidance
- Mitigation: * 2.x users should upgrade to 2.5.9. * 3.x users should upgrade to 3.0.0-M3.
- Users who cannot upgrade immediately should ensure that all model files are sourced from trusted origins and should audit their classpath for classes with side-effecting static initializers or constructors, particularly any that perform JNDI lookups, network requests, or filesystem operations during class initialization.
Red Hat
1 advisory- Advisory severityHigh7.5
High [CVE-2026-42027] Arbitrary Class Loading via Model Manifest
CVE-2026-42027Source published
Arbitrary Class Loading via Model Manifest. Red Hat rates this important (CVSS 7.5). Weakness: CWE-502. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released.
- Affected products in this advisory
- Red Hat Fuse 7
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 2.25
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- Red Hat rates this important; a fix erratum may not be out yet — apply the RHSA as soon as it publishes.
Android app · Google Play
Turn CVE research into alerts on your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.