A critical Regular Expression Denial of Service (ReDoS) vulnerability in Apache OpenNLP allows unauthenticated attackers to crash applications or exhaust system resources via crafted input.

The vulnerability exists in the built-in EMAIL and URL name-finder patterns, which contain ambiguous nested quantifiers. An unauthenticated attacker can supply crafted text that forces the library into super-linear backtracking or unbounded recursion, leading to severe CPU consumption or thread termination.

The exploitation of this flaw can result in significant service disruption, as a single malicious request can pin CPU resources or crash worker threads. Given the CVSS score of 10.0, this vulnerability poses a critical risk to availability, potentially rendering dependent business applications non-functional and requiring manual intervention to restore service.

Immediate Action: Upgrade to Apache OpenNLP version 2.5.12 or 3.0.0-M6, which contain the necessary fixes to the regular expression patterns.

Proactive Monitoring: Monitor application server logs for frequent java.lang.StackOverflowError exceptions and observe CPU usage patterns for unusual, prolonged spikes during text processing tasks.

Compensating Controls: Implement strict input validation or size limits on text submitted to the OpenNLP processing engine to mitigate the impact of excessively large or complex input strings until patching is completed.

Public Exploit Available: No (Exploit_available: unknown)

This vulnerability represents a critical risk to system availability due to the ease with which a remote attacker can trigger resource exhaustion. Administrators should prioritize updating to the fixed versions immediately to eliminate the underlying regex flaw, as no other configuration-based workaround effectively resolves the issue without impacting the intended functionality of the library.