Highest advisory severityHigh 2 vendors · 2 advisories

CVE-2026-43825: Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel Versions Affected: before 3.0.0-M4 (libsvm document…

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

CVE-2026-43825 key facts

CISA KEV: Not listed (catalog checked Nov 6, 2026)
Highest advisory severity: High
CVSS base score: 7.3 (Apache), 7.3 (Red Hat)
Fixed releases: Apache: 3.0.0-M4
Red Hat: 3.0.0
Vendor advisories: 2 from Apache, Red Hat
VulniPulse record: Published Jul 7, 2026 · Updated Jul 20, 2026

Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-43825; bulletin-wide values are not repeated here.

Is CVE-2026-43825 exploited?

No exploitation is reported in the sources VulniPulse tracks: CVE-2026-43825 is not in the CISA KEV catalog (checked Nov 6, 2026) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.

How do I fix CVE-2026-43825?

Upgrade to a fixed release named by the vendor:

Apache: 3.0.0-M4
Red Hat: 3.0.0

Mitigation: 3.x users should upgrade to 3.0.0-M4. (Apache)
Users who cannot upgrade immediately should treat all serialized SvmDoccatModel streams as untrusted input unless their provenance is verified, and should avoid invoking SvmDoccatModel.deserialize() on streams supplied by end users or fetched from third-party sources without integrity checks. (Apache)
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. (Red Hat)

Get an email when Apache publishes the next one.

See Apache's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Apache

Vendor advisory comparison

Apache

1 advisory

Advisory severityHigh7.3
High [CVE-2026-43825] Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel Versions Affected: before 3.0.0-M4 (libsvm document…
CVE-2026-43825Source published Jul 6, 2026Source updated Jul 8, 2026
Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel Versions Affected: before 3.0.0-M4 (libsvm document categorization module; introduced in OPENNLP-1808 and only present on the 3.x line) Description: SvmDoccatModel.deserialize(InputStream) reads an attacker-controlled stream with java.io.ObjectInputStream and calls readObject() without an ObjectInputFilter installed. ObjectInputStream materialises every class referenced in the stream before the resulting object is cast to SvmDoccatModel, so the cast that follows readObject() executes only after the foreign object graph has already been deserialised in full. If a Java deserialization gadget chain is available on the consumer's classpath, a crafted payload supplied to deserialize() executes arbitrary code in the JVM that loads…
Affected products in this advisory
Apache OpenNLP SvmDoccatModel
Source-reported affected versions
3.0.0
Source-reported fixed versions
3.0.0-M4
Mitigation guidance
Mitigation: 3.x users should upgrade to 3.0.0-M4.
Users who cannot upgrade immediately should treat all serialized SvmDoccatModel streams as untrusted input unless their provenance is verified, and should avoid invoking SvmDoccatModel.deserialize() on streams supplied by end users or fetched from third-party sources without integrity checks.
Full advisory and evidence Open source bulletin

Red Hat

1 advisory

Advisory severityHigh7.3
High [CVE-2026-43825] Remote code execution via untrusted Java deserialization
CVE-2026-43825Source published Jul 6, 2026Source updated Jul 6, 2026
Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel Versions Affected: before 3.0.0-M4 (libsvm document categorization module; introduced in OPENNLP-1808 and only present on the 3.x line) Description: SvmDoccatModel.deserialize(InputStream) reads an attacker-controlled stream with java.io.ObjectInputStream and calls readObject() without an ObjectInputFilter installed. ObjectInputStream materialises every class referenced in the stream before the resulting object is cast to SvmDoccatModel, so the cast that follows readObject() executes only after the foreign object graph has already been deserialised in full. If a Java deserialization gadget chain is available on the consumer's classpath, a crafted payload supplied to deserialize() executes arbitrary code in the JVM that loads…
Affected products in this advisory
No product details extracted. Check the source bulletin.
Source-reported affected versions
< 3.0.0-M4
Source-reported fixed versions
3.0.0
Mitigation guidance
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Full advisory and evidence Open source bulletin

All Apache advisories

Follow CVE-2026-43825 in the free weekly digest

Every Monday: whether it was added to CISA KEV, reported exploited, got a fix or changed severity, plus the week's critical and high advisories.

Browse the latest tracked CVEs or the CVEs listed in CISA KEV.

iPhone and Android apps · New on the App Store

Get alerts for new CVEs on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts on Android See app features