[Git][security-tracker-team/security-tracker][master] Add CVE-2026-63317/apache-opennlp

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
012d8c4d by Salvatore Bonaccorso at 2026-07-24T23:08:39+02:00
Add CVE-2026-63317/apache-opennlp

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -328,7 +328,9 @@ CVE-2026-64208 (In the Linux kernel, the following vulnerability has been resolv
 	[bullseye] - linux <not-affected> (Vulnerable code not present)
 	NOTE: https://git.kernel.org/linus/2b50aceafe6606ea52ed42aadd1b4d44a188aade (7.1-rc5)
 CVE-2026-63317 (Arbitrary Class Instantiation via XML Feature Generator Descriptor and ...)
-	TODO: check
+	- apache-opennlp <unfixed>
+	NOTE: https://lists.apache.org/thread/myr446n8t3gv8gq8wbpxm41olx16d8yj
+	NOTE: https://issues.apache.org/jira/browse/OPENNLP-1890
 CVE-2026-58630 (Improper access control in Azure App Service allows an unauthorized at ...)
 	NOT-FOR-US: Microsoft
 CVE-2026-58586 (Image::WebP versions through 0.2 for Perl bundle a vulnerable version  ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/012d8c4d2fcbc97999797b17ebe73ca491a22549

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/012d8c4d2fcbc97999797b17ebe73ca491a22549
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260724/334acf88/attachment.htm>