CPython tarfile, PCRE2, and OpenNLP security fixes

Security traffic on 2026-09-12 centered on a CPython tarfile extraction bypass, a PCRE2 point release carrying five CVEs, and two Apache OpenNLP flaws. The issues affect archive filtering, regular-expression engines, and untrusted model loading.

CPython tarfile hardlink fallback bypasses filter rejection

CVE-2026-87910 was reported against CPython tarfile extraction. When a custom extraction filter returns None to reject an entry, the hardlink fallback path still proceeds and ignores that rejection. Callers that rely on filters to constrain archive contents can therefore see hardlinks extracted against their intent.

PCRE2 10.48 released with five security CVEs

PCRE2 10.48 is out and includes security fixes. Five CVEs were assigned covering JIT compilation, pattern conversion, DFA matching, and integer-overflow problems. Embedders and distributors of the library have a clear upgrade target for those classes of defect.

Apache OpenNLP ReDoS in built-in EMAIL and URL patterns

CVE-2026-82617 covers regular-expression denial of service and stack exhaustion in Apache OpenNLP. The built-in EMAIL and URL patterns supplied by RegexNameFinderFactory are the source. Code that applies those defaults to untrusted text can be driven into excessive backtracking or stack growth.

Apache OpenNLP OOM in SymSpellModelSerializer

CVE-2026-67211 describes a moderate out-of-memory denial of service in Apache OpenNLP. SymSpellModelSerializer performs unbounded array allocation when loading model files, affecting the spellcheck extension in 3.0-M4 and 3.0-M5. Loading untrusted models therefore risks exhausting process memory.