The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP     Versions Affected: - before 2.5.10 - before 3.0.0-M5 Description: Three code paths in Apache OpenNLP load     a class by its fully-qualified name via Class.forName() and invoke its no-arg constructor without any     prior validation of the class name or its type. The affected paths are: (1) GeneratorFactory, which reads     the class attribute of generator elements in an XML feature generator descriptor; such descriptors are     embedded as artifacts in model archives (e.g. TokenNameFinder and POSTagger models) and are parsed during     model loading, so an attacker who can supply a crafted model archive controls the class name directly. (2)     StreamFactoryRegistry.getFactory(Class, String), which falls back to interpreting an unregistered format     name as the fully-qualified class name of an ObjectStreamFactory; this is exploitable in applications that     pass untrusted format names (e.g. exposing the -format parameter of the command-line tooling to external     input). (3) StringInterners, which instantiates the interner implementation named by the     opennlp.interner.class system property; this value is normally deployer-controlled, so it is hardened as     defense in depth rather than being independently attacker-reachable. Exploitation requires a class with     attacker-useful side effects in its static initializer or no-arg constructor (JNDI lookup, outbound     network I/O, filesystem access) to be present on the classpath, so this is not drop-in remote code     execution. T Mitigation: Upgrade to a fixed release. The fix routes all three paths through     ExtensionLoader.instantiateExtension(...), which consults a package-prefix allowlist before     Class.forName() is invoked, so a disallowed class is never loaded, initialized, or constructed. Classes     under the opennlp. prefix remain permitted by default. Deployments that load models referencing feature     generator factories, object stream factories, or string interners outside opennlp.* must opt those     packages in, either programmatically via ExtensionLoader.registerAllowedPackage(String) before the first     model load, or by setting the OPENNLP_EXT_ALLOWED_PACKAGES system property to a comma-separated list of     allowed package prefixes. Users who cannot upgrade immediately should ensure all model files and format     names are sourced from trusted origins and should audit their classpath for classes with side-effecting     static initializers or constructors. (CVE-2026-63317)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-63317

medium Nessus Plugin ID 329693

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.4 Sep 19, 2026, 1:09 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202609191309
Version 1.3 Sep 2, 2026, 6:07 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202609021807
Version 1.2 Jul 28, 2026, 3:13 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202607280313
Version 1.1 Jul 25, 2026, 1:06 PM New Plugin Feed: 202607251306