Security vulnerability: DoS attacks on IBM SPSS Modeler possible

Two vulnerabilities in an integrated open-source library make IBM’s data mining software SPSS Modeler attackable. Attackers can, for example, cause it to crash. IBM has released a security update. So far, there are no indications from IBM that attackers are already exploiting the vulnerabilities.

As stated in a security advisory , the open-source library Apache OpenNLP for Natural Language Processing contains two security vulnerabilities. Since IBM’s data mining software uses this library, it is also vulnerable.

A “ critical ” vulnerability (CVE-2026-82617) affects the processing of certain patterns with regular expressions in emails and URLs. Attackers can thus trigger crashes through crafted requests.

Via the second vulnerability, classified as “ medium, ” an attacker can cause the software to load and execute a Java class present in the classpath. According to IBM, however, this requires that a class useful to attackers is located there – it is not a direct remote code execution.

According to IBM, IBM SPSS Modeler 19.0.0.0 is affected. The company has linked the fix in the security advisory. Those who use Apache OpenNLP themselves should update to version 2.5.12 or 3.0.0-M6.

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.