This is an automated email from the ASF dual-hosted git repository.
github-actions[bot] pushed a commit to branch asf-staging
in repository https://gitbox.apache.org/repos/asf/solr-site.git
The following commit(s) were added to refs/heads/asf-staging by this push:
new 0ba31b14e Commit build products
0ba31b14e is described below
commit 0ba31b14e8e658e748ae9f9fd9fc932f1a427e2e
Author: Build Pelican (action) <[email protected]>
AuthorDate: Wed May 20 07:58:25 2026 +0000
Commit build products
---
output/feeds/all.atom.xml | 68 ++++++++++++++++++++++++-------------
output/feeds/solr/security.atom.xml | 45 +++++++++++++++++++++++-
output/index.html | 2 +-
output/news.html | 37 ++++++++++++++++++++
output/operator/index.html | 2 +-
output/posts.html | 22 +++++++-----
output/posts2.html | 22 +++++-------
output/posts3.html | 26 +++++++-------
output/posts4.html | 26 +++++++-------
output/posts5.html | 26 +++++++-------
output/posts6.html | 26 +++++++-------
output/posts7.html | 26 +++++++-------
output/posts8.html | 26 +++++++-------
output/posts9.html | 13 +++++++
output/security-news.html | 63 ++++++++++++++++++++--------------
output/security-news2.html | 25 ++++++++++++++
output/security.html | 14 ++++----
17 files changed, 310 insertions(+), 159 deletions(-)
diff --git a/output/feeds/all.atom.xml b/output/feeds/all.atom.xml
index b344210f1..93208766c 100644
--- a/output/feeds/all.atom.xml
+++ b/output/feeds/all.atom.xml
@@ -1,5 +1,48 @@
<?xml version="1.0" encoding="utf-8"?>
-<feed xmlns="http://www.w3.org/2005/Atom";><title>Apache Solr</title><link
href="/" rel="alternate"/><link href="/feeds/all.atom.xml"
rel="self"/><id>/</id><updated>2026-03-03T00:00:00+00:00</updated><entry><title>Apache
Solr™ 10.0.0 available</title><link href="/apache-solrtm-1000-available.html"
rel="alternate"/><published>2026-03-03T00:00:00+00:00</published><updated>2026-03-03T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-03-03:/apache-solrtm-1 [...]
+<feed xmlns="http://www.w3.org/2005/Atom";><title>Apache Solr</title><link
href="/" rel="alternate"/><link href="/feeds/all.atom.xml"
rel="self"/><id>/</id><updated>2026-05-19T00:00:00+00:00</updated><entry><title>JWT
Authentication: blockUnknown default allows unauthenticated access contrary to
documentation</title><link
href="/jwt-authentication-blockunknown-default-allows-unauthenticated-access-contrary-to-documentation.html"
rel="alternate"/><published>2026-05-19T00:00:00+00:00</publi [...]
+moderate</p>
+<p><strong>Versions Affected</strong></p>
+<ul>
+<li>Apache Solr 9.0.0 through 9.10.1</li>
+<li>Apache Solr 10.0.0</li>
+</ul>
+<p><strong>Description</strong></p>
+<p>The Apache Solr JWT Authentication Plugin has a configuration
parameter <code>blockUnknown</code>
+that controls whether anonymous (unauthenticated) requests are blocked. The
Reference Guide
+has documented this as defaulting to <code>true</code> since Solr
…</p></summary><content
type="html"><p><strong>Severity</strong>
+moderate</p>
+<p><strong>Versions Affected</strong></p>
+<ul>
+<li>Apache Solr 9.0.0 through 9.10.1</li>
+<li>Apache Solr 10.0.0</li>
+</ul>
+<p><strong>Description</strong></p>
+<p>The Apache Solr JWT Authentication Plugin has a configuration
parameter <code>blockUnknown</code>
+that controls whether anonymous (unauthenticated) requests are blocked. The
Reference Guide
+has documented this as defaulting to <code>true</code> since Solr
9.0, but the code default has always
+been <code>false</code>. Operators who did not explicitly set this
parameter may therefore have been
+unknowingly accepting anonymous requests.</p>
+<p><strong>Am I Affected?</strong></p>
+<p>You may be affected if <strong>all</strong> of the
following are true:</p>
+<ol>
+<li>You use the JWT Authentication Plugin
(<code>solr.JWTAuthPlugin</code>) in
<code>security.json</code></li>
+<li>Your intention is to block all unauthenticated requests</li>
+<li>Your <code>security.json</code> does
<strong>not</strong> explicitly set
<code>blockUnknown</code> to
<code>true</code></li>
+</ol>
+<p>You are <strong>not</strong> affected if any of the
following applies:</p>
+<ul>
+<li><code>blockUnknown</code> is explicitly set to
<code>true</code> in
<code>security.json</code></li>
+<li>An AuthorizationPlugin (e.g.
<code>RuleBasedAuthorizationPlugin</code>) independently denies
access to unauthenticated users</li>
+</ul>
+<p><strong>Mitigation</strong></p>
+<p>Check the <code>authentication</code> section of your
<code>security.json</code>. If
<code>blockUnknown</code> is absent, set it explicitly to
<code>true</code>.</p>
+<p><strong>Fix</strong></p>
+<p>Upcoming Solr 9.11 and 10.1 releases will change the code default of
<code>blockUnknown</code> to <code>true</code>.
+Explicitly setting <code>blockUnknown</code> to
<code>true</code> in a current release is sufficient; upgrading is
not required.</p>
+<p><strong>References</strong></p>
+<ul>
+<li><a
href="https://solr.apache.org/guide/solr/latest/deployment-guide/jwt-authentication-plugin.html">JWT
Authentication Plugin documentation</a></li>
+</ul></content><category
term="solr/security"/></entry><entry><title>Apache Solr™ 10.0.0
available</title><link href="/apache-solrtm-1000-available.html"
rel="alternate"/><published>2026-03-03T00:00:00+00:00</published><updated>2026-03-03T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-03-03:/apache-solrtm-1000-available.html</id><summary
type="html"><p>The Solr PMC is pleased to announce the release of Apache
Solr 10.0.0.</p>
<p>Apache Solr is the blazing-fast, open source, multi-modal search
platform built on the full-text, vector, and geospatial search capabilities of
Apache Lucene. Its major features include powerful full-text search, vector
search, hit highlighting, faceted search …</p></summary><content
type="html"><p>The Solr PMC is pleased to announce the release of Apache
Solr 10.0.0.</p>
<p>Apache Solr is the blazing-fast, open source, multi-modal search
platform built on the full-text, vector, and geospatial search capabilities of
Apache Lucene. Its major features include powerful full-text search, vector
search, hit highlighting, faceted search and analytics, rich document parsing,
geospatial search, extensive REST APIs as well as parallel SQL. Solr is
enterprise grade, secure and highly scalable, providing fault tolerant
distributed search and indexing, and powe [...]
<p>Solr 10.0.0 is available for immediate download at:</p>
@@ -2302,27 +2345,4 @@ features of many of the world's largest internet
sites.</p>
<ul>
<li>Ability to disable configset upload via
-Dconfigset.upload.enabled=false startup parameter</li>
<li>Referal to external resources in various config files now
disallowed</li>
-</ul></content><category term="solr/news"/></entry><entry><title>Apache
Solr™ 7.4.0 available</title><link href="/"
rel="alternate"/><published>2018-06-27T00:00:00+00:00</published><updated>2018-06-27T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2018-06-27:/</id><summary
type="html"><p>The Lucene PMC is pleased to announce the release of
Apache Solr 7.4.0</p>
-<p>Solr is the popular, blazing fast, open source NoSQL search platform
from the
-Apache Lucene project. Its major features include powerful full-text search,
-hit highlighting, faceted search and analytics, rich document parsing,
-geospatial search, extensive …</p></summary><content
type="html"><p>The Lucene PMC is pleased to announce the release of
Apache Solr 7.4.0</p>
-<p>Solr is the popular, blazing fast, open source NoSQL search platform
from the
-Apache Lucene project. Its major features include powerful full-text search,
-hit highlighting, faceted search and analytics, rich document parsing,
-geospatial search, extensive REST APIs as well as parallel SQL. Solr is
-enterprise grade, secure and highly scalable, providing fault tolerant
-distributed search and indexing, and powers the search and navigation
-features of many of the world's largest internet sites.</p>
-<p>Solr 7.4.0 is available for immediate download at:</p>
-<p><a
href="https://solr.apache.org/downloads.html">https://solr.apache.org/downloads.html</a></p>
-<p>Please read CHANGES.txt for a full list of new features and
changes:</p>
-<p><a
href="https://solr.apache.org/7_4_0/changes/Changes.html">https://solr.apache.org/7_4_0/changes/Changes.html</a></p>
-<h3 id="solr-740-release-highlights">Solr 7.4.0 Release Highlights:<a
class="headerlink" href="#solr-740-release-highlights" title="Permanent
link">&para;</a></h3>
-<ul>
-<li>A new 'relatedness()' aggregate function for JSON Faceting to enable
building Semantic Knowledge Graphs.</li>
-<li>Added the TaggerRequestHandler (AKA SolrTextTagger) for tagging
text. It's used as a component of NER/ERD systems including
query-understanding.</li>
-<li>The "Auto Scaling" feature area has been added to and enhanced a
lot.</li>
-<li>The "Streaming Expressions" feature area has been added to and
enhanced a lot.</li>
-<li>Upgraded from Log4j 1.x to 2.x. Solr continues to log via
SLF4J.</li>
</ul></content><category term="solr/news"/></entry></feed>
\ No newline at end of file
diff --git a/output/feeds/solr/security.atom.xml
b/output/feeds/solr/security.atom.xml
index 981c38784..2bbb65ce9 100644
--- a/output/feeds/solr/security.atom.xml
+++ b/output/feeds/solr/security.atom.xml
@@ -1,5 +1,48 @@
<?xml version="1.0" encoding="utf-8"?>
-<feed xmlns="http://www.w3.org/2005/Atom";><title>Apache Solr -
solr/security</title><link href="/" rel="alternate"/><link
href="/feeds/solr/security.atom.xml"
rel="self"/><id>/</id><updated>2026-01-20T00:00:00+00:00</updated><entry><title>CVE-2026-22022:
Unauthorized bypass of certain "predefined permission" rules in the
RuleBasedAuthorizationPlugin</title><link
href="/cve-2026-22022-unauthorized-bypass-of-certain-predefined-permission-rules-in-the-rulebasedauthorizationplugin.html"
rel= [...]
+<feed xmlns="http://www.w3.org/2005/Atom";><title>Apache Solr -
solr/security</title><link href="/" rel="alternate"/><link
href="/feeds/solr/security.atom.xml"
rel="self"/><id>/</id><updated>2026-05-19T00:00:00+00:00</updated><entry><title>JWT
Authentication: blockUnknown default allows unauthenticated access contrary to
documentation</title><link
href="/jwt-authentication-blockunknown-default-allows-unauthenticated-access-contrary-to-documentation.html"
rel="alternate"/><published>2026-0 [...]
+moderate</p>
+<p><strong>Versions Affected</strong></p>
+<ul>
+<li>Apache Solr 9.0.0 through 9.10.1</li>
+<li>Apache Solr 10.0.0</li>
+</ul>
+<p><strong>Description</strong></p>
+<p>The Apache Solr JWT Authentication Plugin has a configuration
parameter <code>blockUnknown</code>
+that controls whether anonymous (unauthenticated) requests are blocked. The
Reference Guide
+has documented this as defaulting to <code>true</code> since Solr
…</p></summary><content
type="html"><p><strong>Severity</strong>
+moderate</p>
+<p><strong>Versions Affected</strong></p>
+<ul>
+<li>Apache Solr 9.0.0 through 9.10.1</li>
+<li>Apache Solr 10.0.0</li>
+</ul>
+<p><strong>Description</strong></p>
+<p>The Apache Solr JWT Authentication Plugin has a configuration
parameter <code>blockUnknown</code>
+that controls whether anonymous (unauthenticated) requests are blocked. The
Reference Guide
+has documented this as defaulting to <code>true</code> since Solr
9.0, but the code default has always
+been <code>false</code>. Operators who did not explicitly set this
parameter may therefore have been
+unknowingly accepting anonymous requests.</p>
+<p><strong>Am I Affected?</strong></p>
+<p>You may be affected if <strong>all</strong> of the
following are true:</p>
+<ol>
+<li>You use the JWT Authentication Plugin
(<code>solr.JWTAuthPlugin</code>) in
<code>security.json</code></li>
+<li>Your intention is to block all unauthenticated requests</li>
+<li>Your <code>security.json</code> does
<strong>not</strong> explicitly set
<code>blockUnknown</code> to
<code>true</code></li>
+</ol>
+<p>You are <strong>not</strong> affected if any of the
following applies:</p>
+<ul>
+<li><code>blockUnknown</code> is explicitly set to
<code>true</code> in
<code>security.json</code></li>
+<li>An AuthorizationPlugin (e.g.
<code>RuleBasedAuthorizationPlugin</code>) independently denies
access to unauthenticated users</li>
+</ul>
+<p><strong>Mitigation</strong></p>
+<p>Check the <code>authentication</code> section of your
<code>security.json</code>. If
<code>blockUnknown</code> is absent, set it explicitly to
<code>true</code>.</p>
+<p><strong>Fix</strong></p>
+<p>Upcoming Solr 9.11 and 10.1 releases will change the code default of
<code>blockUnknown</code> to <code>true</code>.
+Explicitly setting <code>blockUnknown</code> to
<code>true</code> in a current release is sufficient; upgrading is
not required.</p>
+<p><strong>References</strong></p>
+<ul>
+<li><a
href="https://solr.apache.org/guide/solr/latest/deployment-guide/jwt-authentication-plugin.html">JWT
Authentication Plugin documentation</a></li>
+</ul></content><category
term="solr/security"/></entry><entry><title>CVE-2026-22022: Unauthorized bypass
of certain "predefined permission" rules in the
RuleBasedAuthorizationPlugin</title><link
href="/cve-2026-22022-unauthorized-bypass-of-certain-predefined-permission-rules-in-the-rulebasedauthorizationplugin.html"
rel="alternate"/><published>2026-01-20T00:00:00+00:00</published><updated>2026-01-20T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2 [...]
moderate</p>
<p><strong>Description</strong>
Deployments of Apache Solr 5.3.0 through 9.10.0 that rely on Solr's "Rule
Based Authorization Plugin" are vulnerable to allowing unauthorized access to
certain Solr APIs, due to insufficiently strict input validation in those
components. Only deployments that meet all of the following criteria
…</p></summary><content
type="html"><p><strong>Severity</strong>
diff --git a/output/index.html b/output/index.html
index 9757b5c41..95cee0951 100644
--- a/output/index.html
+++ b/output/index.html
@@ -127,7 +127,7 @@
</div>
<div class="header-fill"></div>
-<section class="security" latest-date="2026-01-20">
+<section class="security" latest-date="2026-05-19">
<div class="row">
<div class="large-12 columns text-center">
<h2><a href="security.html">⚠ There are recent security
announcements. Read more on the Security page.</a></h2>
diff --git a/output/news.html b/output/news.html
index b424deeae..97e8a6590 100644
--- a/output/news.html
+++ b/output/news.html
@@ -145,6 +145,43 @@
<h1 id="solr-news">Solr<sup>™</sup> Announcements<a class="headerlink"
href="#solr-news" title="Permanent link">¶</a></h1>
<p>You may also read these news as ATOM feeds: <a
href="/feeds/solr/news.atom.xml">Announcements</a>, <a
href="/feeds/solr/security.atom.xml">Security Announcements</a>..</p>
+ <h2
id="jwt-authentication-blockunknown-default-allows-unauthenticated-access-contrary-to-documentation">19
May 2026, JWT Authentication: blockUnknown default allows unauthenticated
access contrary to documentation
+ <a class="headerlink"
href="#jwt-authentication-blockunknown-default-allows-unauthenticated-access-contrary-to-documentation"
title="Permanent link">¶</a>
+ </h2>
+ <p><strong>Severity</strong>
+moderate</p>
+<p><strong>Versions Affected</strong></p>
+<ul>
+<li>Apache Solr 9.0.0 through 9.10.1</li>
+<li>Apache Solr 10.0.0</li>
+</ul>
+<p><strong>Description</strong></p>
+<p>The Apache Solr JWT Authentication Plugin has a configuration parameter
<code>blockUnknown</code>
+that controls whether anonymous (unauthenticated) requests are blocked. The
Reference Guide
+has documented this as defaulting to <code>true</code> since Solr 9.0, but the
code default has always
+been <code>false</code>. Operators who did not explicitly set this parameter
may therefore have been
+unknowingly accepting anonymous requests.</p>
+<p><strong>Am I Affected?</strong></p>
+<p>You may be affected if <strong>all</strong> of the following are true:</p>
+<ol>
+<li>You use the JWT Authentication Plugin (<code>solr.JWTAuthPlugin</code>) in
<code>security.json</code></li>
+<li>Your intention is to block all unauthenticated requests</li>
+<li>Your <code>security.json</code> does <strong>not</strong> explicitly set
<code>blockUnknown</code> to <code>true</code></li>
+</ol>
+<p>You are <strong>not</strong> affected if any of the following applies:</p>
+<ul>
+<li><code>blockUnknown</code> is explicitly set to <code>true</code> in
<code>security.json</code></li>
+<li>An AuthorizationPlugin (e.g. <code>RuleBasedAuthorizationPlugin</code>)
independently denies access to unauthenticated users</li>
+</ul>
+<p><strong>Mitigation</strong></p>
+<p>Check the <code>authentication</code> section of your
<code>security.json</code>. If <code>blockUnknown</code> is absent, set it
explicitly to <code>true</code>.</p>
+<p><strong>Fix</strong></p>
+<p>Upcoming Solr 9.11 and 10.1 releases will change the code default of
<code>blockUnknown</code> to <code>true</code>.
+Explicitly setting <code>blockUnknown</code> to <code>true</code> in a current
release is sufficient; upgrading is not required.</p>
+<p><strong>References</strong></p>
+<ul>
+<li><a
href="https://solr.apache.org/guide/solr/latest/deployment-guide/jwt-authentication-plugin.html";>JWT
Authentication Plugin documentation</a></li>
+</ul>
<h2 id="apache-solrtm-1000-available">3 March 2026, Apache Solr™ 10.0.0
available
<a class="headerlink" href="#apache-solrtm-1000-available"
title="Permanent link">¶</a>
</h2>
diff --git a/output/operator/index.html b/output/operator/index.html
index 883d6ef2a..71030db5b 100644
--- a/output/operator/index.html
+++ b/output/operator/index.html
@@ -122,7 +122,7 @@
</div>
<div class="header-fill"></div>
-<section class="security" latest-date="2026-01-20">
+<section class="security" latest-date="2026-05-19">
<div class="row">
<div class="large-12 columns text-center">
<h2><a href="/security.html">⚠ There are recent security
announcements. Read more on the Solr Security page.</a></h2>
diff --git a/output/posts.html b/output/posts.html
index ddbde09b8..044f2646d 100644
--- a/output/posts.html
+++ b/output/posts.html
@@ -152,6 +152,19 @@
<h1 id="solr-news">Solr<sup>™</sup> News<a class="headerlink"
href="#solr-news" title="Permanent link">¶</a></h1>
+ <h2
id="jwt-authentication-blockunknown-default-allows-unauthenticated-access-contrary-to-documentation"
class="post-item-title">
+ <a
href="/news.html#jwt-authentication-blockunknown-default-allows-unauthenticated-access-contrary-to-documentation">JWT
Authentication: blockUnknown default allows unauthenticated access contrary to
documentation</a>
+ <a class="headerlink"
href="#jwt-authentication-blockunknown-default-allows-unauthenticated-access-contrary-to-documentation"
title="Permanent link">¶</a>
+ </h2>
+ <h5>
+ <strong>Security:</strong>
+ 19 May 2026
+ </h5>
+ <p>Severity moderate Versions Affected Apache Solr 9.0.0 through 9.10.1
Apache Solr 10.0.0 Description The Apache Solr JWT Authentication Plugin has a
configuration parameter blockUnknown that controls whether anonymous
(unauthenticated) requests are blocked. The Reference Guide has documented this
as defaulting to true since Solr …</p>
+ <div class="read-more">
+ <a
href="/news.html#jwt-authentication-blockunknown-default-allows-unauthenticated-access-contrary-to-documentation">Read
full article on news page →</a>
+ </div>
+ <hr/>
<h2 id="solr-lucene-migration-correctness" class="post-item-title">
<a href="blogposts/solr-lucene-migration-correctness.html">Validating
Ranking Correctness During Solr/Lucene Migrations</a>
<a class="headerlink" href="#solr-lucene-migration-correctness"
title="Permanent link">¶</a>
@@ -379,15 +392,6 @@
<a
href="/news.html#cve-2024-45217-apache-solr-configsets-created-during-a-backup-restore-command-are-trusted-implicitly">Read
full article on news page →</a>
</div>
<hr/>
- <h2 id="community-over-code-na-2024-birds-of-a-feather"
class="post-item-title">
- <a
href="blogposts/community-over-code-na-2024-birds-of-a-feather.html">Community
Over Code NA 2024 Apache Lucene/Solr Birds Of A Feather</a>
- <a class="headerlink"
href="#community-over-code-na-2024-birds-of-a-feather" title="Permanent
link">¶</a>
- </h2>
- <h5>
- 14 October 2024
- </h5>
- <p>This blog post is a summary of the Apache Lucene/Solr Birds of a
Feather from Community Over Code NA 2024 in Denver. Written by Eric Pugh and
Stefan Vodita.</p>
- <hr/>
<div class="pagination">
<span class="pagination-info">
diff --git a/output/posts2.html b/output/posts2.html
index 55040fe7f..30bf123c9 100644
--- a/output/posts2.html
+++ b/output/posts2.html
@@ -152,6 +152,15 @@
<h1 id="solr-news">Solr<sup>™</sup> News<a class="headerlink"
href="#solr-news" title="Permanent link">¶</a></h1>
+ <h2 id="community-over-code-na-2024-birds-of-a-feather"
class="post-item-title">
+ <a
href="blogposts/community-over-code-na-2024-birds-of-a-feather.html">Community
Over Code NA 2024 Apache Lucene/Solr Birds Of A Feather</a>
+ <a class="headerlink"
href="#community-over-code-na-2024-birds-of-a-feather" title="Permanent
link">¶</a>
+ </h2>
+ <h5>
+ 14 October 2024
+ </h5>
+ <p>This blog post is a summary of the Apache Lucene/Solr Birds of a
Feather from Community Over Code NA 2024 in Denver. Written by Eric Pugh and
Stefan Vodita.</p>
+ <hr/>
<h2 id="categorical-features-in-apache-solr-learning-to-rank"
class="post-item-title">
<a
href="blogposts/categorical-features-in-apache-solr-learning-to-rank.html">Categorical
Features in Apache Solr Learning to Rank</a>
<a class="headerlink"
href="#categorical-features-in-apache-solr-learning-to-rank" title="Permanent
link">¶</a>
@@ -359,19 +368,6 @@
<a
href="/news.html#cve-2023-50292-apache-solr-schema-designer-blindly-trusts-all-configsets-possibly-leading-to-rce-by-unauthenticated-users">Read
full article on news page →</a>
</div>
<hr/>
- <h2
id="cve-2023-50298-apache-solr-can-expose-zookeeper-credentials-via-streaming-expressions"
class="post-item-title">
- <a
href="/news.html#cve-2023-50298-apache-solr-can-expose-zookeeper-credentials-via-streaming-expressions">CVE-2023-50298:
Apache Solr can expose ZooKeeper credentials via Streaming Expressions</a>
- <a class="headerlink"
href="#cve-2023-50298-apache-solr-can-expose-zookeeper-credentials-via-streaming-expressions"
title="Permanent link">¶</a>
- </h2>
- <h5>
- <strong>Security:</strong>
- 8 February 2024
- </h5>
- <p>Severity: Low Versions Affected: Apache Solr 6.0.0 through 8.11.2
Apache Solr 9.0.0 before 9.4.1 Description: Exposure of Sensitive Information
to an Unauthorized Actor vulnerability in Apache Solr.This issue affects Apache
Solr: from 6.0.0 through 8.11.2, from 9 …</p>
- <div class="read-more">
- <a
href="/news.html#cve-2023-50298-apache-solr-can-expose-zookeeper-credentials-via-streaming-expressions">Read
full article on news page →</a>
- </div>
- <hr/>
<div class="pagination">
<a href="/posts.html">← Previous</a>
diff --git a/output/posts3.html b/output/posts3.html
index 1cc1cc699..676e11287 100644
--- a/output/posts3.html
+++ b/output/posts3.html
@@ -152,6 +152,19 @@
<h1 id="solr-news">Solr<sup>™</sup> News<a class="headerlink"
href="#solr-news" title="Permanent link">¶</a></h1>
+ <h2
id="cve-2023-50298-apache-solr-can-expose-zookeeper-credentials-via-streaming-expressions"
class="post-item-title">
+ <a
href="/news.html#cve-2023-50298-apache-solr-can-expose-zookeeper-credentials-via-streaming-expressions">CVE-2023-50298:
Apache Solr can expose ZooKeeper credentials via Streaming Expressions</a>
+ <a class="headerlink"
href="#cve-2023-50298-apache-solr-can-expose-zookeeper-credentials-via-streaming-expressions"
title="Permanent link">¶</a>
+ </h2>
+ <h5>
+ <strong>Security:</strong>
+ 8 February 2024
+ </h5>
+ <p>Severity: Low Versions Affected: Apache Solr 6.0.0 through 8.11.2
Apache Solr 9.0.0 before 9.4.1 Description: Exposure of Sensitive Information
to an Unauthorized Actor vulnerability in Apache Solr.This issue affects Apache
Solr: from 6.0.0 through 8.11.2, from 9 …</p>
+ <div class="read-more">
+ <a
href="/news.html#cve-2023-50298-apache-solr-can-expose-zookeeper-credentials-via-streaming-expressions">Read
full article on news page →</a>
+ </div>
+ <hr/>
<h2
id="cve-2023-50386-apache-solr-backuprestore-apis-allow-for-deployment-of-executables-in-malicious-configsets"
class="post-item-title">
<a
href="/news.html#cve-2023-50386-apache-solr-backuprestore-apis-allow-for-deployment-of-executables-in-malicious-configsets">CVE-2023-50386:
Apache Solr: Backup/Restore APIs allow for deployment of executables in
malicious ConfigSets</a>
<a class="headerlink"
href="#cve-2023-50386-apache-solr-backuprestore-apis-allow-for-deployment-of-executables-in-malicious-configsets"
title="Permanent link">¶</a>
@@ -399,19 +412,6 @@
<a href="/news.html#apache-solrtm-8110-available">Read full article on
news page →</a>
</div>
<hr/>
- <h2 id="apache-solrtm-8101-available" class="post-item-title">
- <a href="/news.html#apache-solrtm-8101-available">Apache Solr™ 8.10.1
available</a>
- <a class="headerlink" href="#apache-solrtm-8101-available"
title="Permanent link">¶</a>
- </h2>
- <h5>
- <strong>News:</strong>
- 18 October 2021
- </h5>
- <p>The Solr PMC is pleased to announce the release of Apache Solr
8.10.1. Solr is the popular, blazing fast, open source NoSQL search platform
from the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document handling, and …</p>
- <div class="read-more">
- <a href="/news.html#apache-solrtm-8101-available">Read full article on
news page →</a>
- </div>
- <hr/>
<div class="pagination">
<a href="/posts2.html">← Previous</a>
diff --git a/output/posts4.html b/output/posts4.html
index 49e31e414..ace8d651f 100644
--- a/output/posts4.html
+++ b/output/posts4.html
@@ -152,6 +152,19 @@
<h1 id="solr-news">Solr<sup>™</sup> News<a class="headerlink"
href="#solr-news" title="Permanent link">¶</a></h1>
+ <h2 id="apache-solrtm-8101-available" class="post-item-title">
+ <a href="/news.html#apache-solrtm-8101-available">Apache Solr™ 8.10.1
available</a>
+ <a class="headerlink" href="#apache-solrtm-8101-available"
title="Permanent link">¶</a>
+ </h2>
+ <h5>
+ <strong>News:</strong>
+ 18 October 2021
+ </h5>
+ <p>The Solr PMC is pleased to announce the release of Apache Solr
8.10.1. Solr is the popular, blazing fast, open source NoSQL search platform
from the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document handling, and …</p>
+ <div class="read-more">
+ <a href="/news.html#apache-solrtm-8101-available">Read full article on
news page →</a>
+ </div>
+ <hr/>
<h2 id="apache-solrtm-8100-available" class="post-item-title">
<a href="/news.html#apache-solrtm-8100-available">Apache Solr™ 8.10.0
available</a>
<a class="headerlink" href="#apache-solrtm-8100-available"
title="Permanent link">¶</a>
@@ -399,19 +412,6 @@
<a href="/news.html#apache-solrtm-851-available">Read full article on
news page →</a>
</div>
<hr/>
- <h2 id="apache-solrtm-850-available" class="post-item-title">
- <a href="/news.html#apache-solrtm-850-available">Apache Solr™ 8.5.0
available</a>
- <a class="headerlink" href="#apache-solrtm-850-available"
title="Permanent link">¶</a>
- </h2>
- <h5>
- <strong>News:</strong>
- 24 March 2020
- </h5>
- <p>The Lucene PMC is pleased to announce the release of Apache Solr
8.5.0. Solr is the popular, blazing fast, open source NoSQL search platform
from the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document handling, and …</p>
- <div class="read-more">
- <a href="/news.html#apache-solrtm-850-available">Read full article on
news page →</a>
- </div>
- <hr/>
<div class="pagination">
<a href="/posts3.html">← Previous</a>
diff --git a/output/posts5.html b/output/posts5.html
index 82fda6f2b..d6a4de336 100644
--- a/output/posts5.html
+++ b/output/posts5.html
@@ -152,6 +152,19 @@
<h1 id="solr-news">Solr<sup>™</sup> News<a class="headerlink"
href="#solr-news" title="Permanent link">¶</a></h1>
+ <h2 id="apache-solrtm-850-available" class="post-item-title">
+ <a href="/news.html#apache-solrtm-850-available">Apache Solr™ 8.5.0
available</a>
+ <a class="headerlink" href="#apache-solrtm-850-available"
title="Permanent link">¶</a>
+ </h2>
+ <h5>
+ <strong>News:</strong>
+ 24 March 2020
+ </h5>
+ <p>The Lucene PMC is pleased to announce the release of Apache Solr
8.5.0. Solr is the popular, blazing fast, open source NoSQL search platform
from the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document handling, and …</p>
+ <div class="read-more">
+ <a href="/news.html#apache-solrtm-850-available">Read full article on
news page →</a>
+ </div>
+ <hr/>
<h2 id="apache-solrtm-841-available" class="post-item-title">
<a href="/news.html#apache-solrtm-841-available">Apache Solr™ 8.4.1
available</a>
<a class="headerlink" href="#apache-solrtm-841-available"
title="Permanent link">¶</a>
@@ -399,19 +412,6 @@
<a href="/news.html#cve-2017-3164-ssrf-issue-in-apache-solr">Read full
article on news page →</a>
</div>
<hr/>
- <h2 id="apache-solrtm-770-available" class="post-item-title">
- <a href="/news.html#apache-solrtm-770-available">Apache Solr™ 7.7.0
available</a>
- <a class="headerlink" href="#apache-solrtm-770-available"
title="Permanent link">¶</a>
- </h2>
- <h5>
- <strong>News:</strong>
- 11 February 2019
- </h5>
- <p>The Lucene PMC is pleased to announce the release of Apache Solr
7.7.0 Solr is the popular, blazing fast, open source NoSQL search platform from
the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document (e.g …</p>
- <div class="read-more">
- <a href="/news.html#apache-solrtm-770-available">Read full article on
news page →</a>
- </div>
- <hr/>
<div class="pagination">
<a href="/posts4.html">← Previous</a>
diff --git a/output/posts6.html b/output/posts6.html
index 9d5dc819a..1d1252c80 100644
--- a/output/posts6.html
+++ b/output/posts6.html
@@ -152,6 +152,19 @@
<h1 id="solr-news">Solr<sup>™</sup> News<a class="headerlink"
href="#solr-news" title="Permanent link">¶</a></h1>
+ <h2 id="apache-solrtm-770-available" class="post-item-title">
+ <a href="/news.html#apache-solrtm-770-available">Apache Solr™ 7.7.0
available</a>
+ <a class="headerlink" href="#apache-solrtm-770-available"
title="Permanent link">¶</a>
+ </h2>
+ <h5>
+ <strong>News:</strong>
+ 11 February 2019
+ </h5>
+ <p>The Lucene PMC is pleased to announce the release of Apache Solr
7.7.0 Solr is the popular, blazing fast, open source NoSQL search platform from
the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document (e.g …</p>
+ <div class="read-more">
+ <a href="/news.html#apache-solrtm-770-available">Read full article on
news page →</a>
+ </div>
+ <hr/>
<h2 id="apache-solrtm-760-available" class="post-item-title">
<a href="/news.html#apache-solrtm-760-available">Apache Solr™ 7.6.0
available</a>
<a class="headerlink" href="#apache-solrtm-760-available"
title="Permanent link">¶</a>
@@ -399,19 +412,6 @@
<a href="/news.html#apache-solrtm-701-available">Read full article on
news page →</a>
</div>
<hr/>
- <h2 id="apache-solr-reference-guide-for-70-available"
class="post-item-title">
- <a
href="/news.html#apache-solr-reference-guide-for-70-available">Apache Solr
Reference Guide for 7.0 available</a>
- <a class="headerlink"
href="#apache-solr-reference-guide-for-70-available" title="Permanent
link">¶</a>
- </h2>
- <h5>
- <strong>News:</strong>
- 2 October 2017
- </h5>
- <p>The Lucene PMC is pleased to announce the release of the Apache Solr
Reference Guide for Solr 7.0. This 1,035-page PDF is the definitive guide to
Solr. This version adds documentation for new features of Solr, plus detailed
information about changes and deprecations you should know about when …</p>
- <div class="read-more">
- <a href="/news.html#apache-solr-reference-guide-for-70-available">Read
full article on news page →</a>
- </div>
- <hr/>
<div class="pagination">
<a href="/posts5.html">← Previous</a>
diff --git a/output/posts7.html b/output/posts7.html
index cefd27007..f11937b0a 100644
--- a/output/posts7.html
+++ b/output/posts7.html
@@ -152,6 +152,19 @@
<h1 id="solr-news">Solr<sup>™</sup> News<a class="headerlink"
href="#solr-news" title="Permanent link">¶</a></h1>
+ <h2 id="apache-solr-reference-guide-for-70-available"
class="post-item-title">
+ <a
href="/news.html#apache-solr-reference-guide-for-70-available">Apache Solr
Reference Guide for 7.0 available</a>
+ <a class="headerlink"
href="#apache-solr-reference-guide-for-70-available" title="Permanent
link">¶</a>
+ </h2>
+ <h5>
+ <strong>News:</strong>
+ 2 October 2017
+ </h5>
+ <p>The Lucene PMC is pleased to announce the release of the Apache Solr
Reference Guide for Solr 7.0. This 1,035-page PDF is the definitive guide to
Solr. This version adds documentation for new features of Solr, plus detailed
information about changes and deprecations you should know about when …</p>
+ <div class="read-more">
+ <a href="/news.html#apache-solr-reference-guide-for-70-available">Read
full article on news page →</a>
+ </div>
+ <hr/>
<h2 id="apache-solrtm-700-available" class="post-item-title">
<a href="/news.html#apache-solrtm-700-available">Apache Solr™ 7.0.0
available</a>
<a class="headerlink" href="#apache-solrtm-700-available"
title="Permanent link">¶</a>
@@ -399,19 +412,6 @@
<a href="/news.html#apache-solr-620-available">Read full article on
news page →</a>
</div>
<hr/>
- <h2 id="apache-solr-552-available" class="post-item-title">
- <a href="/news.html#apache-solr-552-available">Apache Solr 5.5.2
available</a>
- <a class="headerlink" href="#apache-solr-552-available" title="Permanent
link">¶</a>
- </h2>
- <h5>
- <strong>News:</strong>
- 25 June 2016
- </h5>
- <p>The Lucene PMC is pleased to announce the release of Apache Solr
5.5.2 Solr is the popular, blazing fast, open source NoSQL search platform from
the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document (e.g …</p>
- <div class="read-more">
- <a href="/news.html#apache-solr-552-available">Read full article on
news page →</a>
- </div>
- <hr/>
<div class="pagination">
<a href="/posts6.html">← Previous</a>
diff --git a/output/posts8.html b/output/posts8.html
index a98021271..68659c68b 100644
--- a/output/posts8.html
+++ b/output/posts8.html
@@ -152,6 +152,19 @@
<h1 id="solr-news">Solr<sup>™</sup> News<a class="headerlink"
href="#solr-news" title="Permanent link">¶</a></h1>
+ <h2 id="apache-solr-552-available" class="post-item-title">
+ <a href="/news.html#apache-solr-552-available">Apache Solr 5.5.2
available</a>
+ <a class="headerlink" href="#apache-solr-552-available" title="Permanent
link">¶</a>
+ </h2>
+ <h5>
+ <strong>News:</strong>
+ 25 June 2016
+ </h5>
+ <p>The Lucene PMC is pleased to announce the release of Apache Solr
5.5.2 Solr is the popular, blazing fast, open source NoSQL search platform from
the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document (e.g …</p>
+ <div class="read-more">
+ <a href="/news.html#apache-solr-552-available">Read full article on
news page →</a>
+ </div>
+ <hr/>
<h2 id="apache-solr-610-available" class="post-item-title">
<a href="/news.html#apache-solr-610-available">Apache Solr 6.1.0
available</a>
<a class="headerlink" href="#apache-solr-610-available" title="Permanent
link">¶</a>
@@ -399,19 +412,6 @@
<a
href="/news.html#apache-solr-500-and-reference-guide-for-50-available">Read
full article on news page →</a>
</div>
<hr/>
- <h2 id="apache-solr-4103-available" class="post-item-title">
- <a href="/news.html#apache-solr-4103-available">Apache Solr 4.10.3
Available</a>
- <a class="headerlink" href="#apache-solr-4103-available"
title="Permanent link">¶</a>
- </h2>
- <h5>
- <strong>News:</strong>
- 29 December 2014
- </h5>
- <p>The Lucene PMC is pleased to announce the release of Apache Solr
4.10.3 Solr is the popular, blazing fast, open source NoSQL search platform
from the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document (e.g …</p>
- <div class="read-more">
- <a href="/news.html#apache-solr-4103-available">Read full article on
news page →</a>
- </div>
- <hr/>
<div class="pagination">
<a href="/posts7.html">← Previous</a>
diff --git a/output/posts9.html b/output/posts9.html
index f5ad05c47..d383fa866 100644
--- a/output/posts9.html
+++ b/output/posts9.html
@@ -152,6 +152,19 @@
<h1 id="solr-news">Solr<sup>™</sup> News<a class="headerlink"
href="#solr-news" title="Permanent link">¶</a></h1>
+ <h2 id="apache-solr-4103-available" class="post-item-title">
+ <a href="/news.html#apache-solr-4103-available">Apache Solr 4.10.3
Available</a>
+ <a class="headerlink" href="#apache-solr-4103-available"
title="Permanent link">¶</a>
+ </h2>
+ <h5>
+ <strong>News:</strong>
+ 29 December 2014
+ </h5>
+ <p>The Lucene PMC is pleased to announce the release of Apache Solr
4.10.3 Solr is the popular, blazing fast, open source NoSQL search platform
from the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document (e.g …</p>
+ <div class="read-more">
+ <a href="/news.html#apache-solr-4103-available">Read full article on
news page →</a>
+ </div>
+ <hr/>
<h2 id="apache-solr-4102-available" class="post-item-title">
<a href="/news.html#apache-solr-4102-available">Apache Solr 4.10.2
Available</a>
<a class="headerlink" href="#apache-solr-4102-available"
title="Permanent link">¶</a>
diff --git a/output/security-news.html b/output/security-news.html
index 144485098..9cb987e37 100644
--- a/output/security-news.html
+++ b/output/security-news.html
@@ -144,6 +144,44 @@
<h1 id="solr-security-news">Solr<sup>™</sup> Security News<a
class="headerlink" href="#solr-security-news" title="Permanent link">¶</a></h1>
<p>Full history of Apache Solr security advisories. Subscribe to the <a
href="/feeds/solr/security.atom.xml">security ATOM feed</a> to be notified of
new advisories.</p>
+ <h2
id="jwt-authentication-blockunknown-default-allows-unauthenticated-access-contrary-to-documentation">2026-05-19,
JWT Authentication: blockUnknown default allows unauthenticated access
contrary to documentation
+ <a class="headerlink"
href="#jwt-authentication-blockunknown-default-allows-unauthenticated-access-contrary-to-documentation"
title="Permanent link">¶</a>
+ </h2>
+ <p><strong>Severity</strong>
+moderate</p>
+<p><strong>Versions Affected</strong></p>
+<ul>
+<li>Apache Solr 9.0.0 through 9.10.1</li>
+<li>Apache Solr 10.0.0</li>
+</ul>
+<p><strong>Description</strong></p>
+<p>The Apache Solr JWT Authentication Plugin has a configuration parameter
<code>blockUnknown</code>
+that controls whether anonymous (unauthenticated) requests are blocked. The
Reference Guide
+has documented this as defaulting to <code>true</code> since Solr 9.0, but the
code default has always
+been <code>false</code>. Operators who did not explicitly set this parameter
may therefore have been
+unknowingly accepting anonymous requests.</p>
+<p><strong>Am I Affected?</strong></p>
+<p>You may be affected if <strong>all</strong> of the following are true:</p>
+<ol>
+<li>You use the JWT Authentication Plugin (<code>solr.JWTAuthPlugin</code>) in
<code>security.json</code></li>
+<li>Your intention is to block all unauthenticated requests</li>
+<li>Your <code>security.json</code> does <strong>not</strong> explicitly set
<code>blockUnknown</code> to <code>true</code></li>
+</ol>
+<p>You are <strong>not</strong> affected if any of the following applies:</p>
+<ul>
+<li><code>blockUnknown</code> is explicitly set to <code>true</code> in
<code>security.json</code></li>
+<li>An AuthorizationPlugin (e.g. <code>RuleBasedAuthorizationPlugin</code>)
independently denies access to unauthenticated users</li>
+</ul>
+<p><strong>Mitigation</strong></p>
+<p>Check the <code>authentication</code> section of your
<code>security.json</code>. If <code>blockUnknown</code> is absent, set it
explicitly to <code>true</code>.</p>
+<p><strong>Fix</strong></p>
+<p>Upcoming Solr 9.11 and 10.1 releases will change the code default of
<code>blockUnknown</code> to <code>true</code>.
+Explicitly setting <code>blockUnknown</code> to <code>true</code> in a current
release is sufficient; upgrading is not required.</p>
+<p><strong>References</strong></p>
+<ul>
+<li><a
href="https://solr.apache.org/guide/solr/latest/deployment-guide/jwt-authentication-plugin.html";>JWT
Authentication Plugin documentation</a></li>
+</ul>
+ <hr/>
<h2
id="cve-2026-22022-unauthorized-bypass-of-certain-predefined-permission-rules-in-the-rulebasedauthorizationplugin">2026-01-20,
CVE-2026-22022: Unauthorized bypass of certain "predefined permission" rules
in the RuleBasedAuthorizationPlugin
<a class="headerlink"
href="#cve-2026-22022-unauthorized-bypass-of-certain-predefined-permission-rules-in-the-rulebasedauthorizationplugin"
title="Permanent link">¶</a>
</h2>
@@ -630,31 +668,6 @@ Geza Nagy</p>
<p><strong>References:</strong>
<a href="https://issues.apache.org/jira/browse/SOLR-15233";>SOLR-15233</a>:
CVE-2021-29943: Apache Solr Unprivileged users may be able to perform
unauthorized read/write to collections </p>
<hr/>
- <h2
id="cve-2020-13957-the-checks-added-to-unauthenticated-configset-uploads-in-apache-solr-can-be-circumvented">2020-10-12,
CVE-2020-13957: The checks added to unauthenticated configset uploads in
Apache Solr can be circumvented
- <a class="headerlink"
href="#cve-2020-13957-the-checks-added-to-unauthenticated-configset-uploads-in-apache-solr-can-be-circumvented"
title="Permanent link">¶</a>
- </h2>
- <p><strong>Severity:</strong>
-High</p>
-<p><strong>Versions Affected:</strong>
-6.6.0 to 6.6.6
-7.0.0 to 7.7.3
-8.0.0 to 8.6.2</p>
-<p><strong>Description:</strong>
-Solr prevents some features considered dangerous (which could be used for
remote code execution) to be configured in a ConfigSet that's uploaded via API
without authentication/authorization. The checks in place to prevent such
features can be circumvented by using a combination of UPLOAD/CREATE
actions.</p>
-<p><strong>Mitigation:</strong>
-Any of the following are enough to prevent this vulnerability:</p>
-<ul>
-<li>Disable UPLOAD command in ConfigSets API if not used by setting the system
property: <code>configset.upload.enabled</code> to <code>false</code> (<a
href="https://solr.apache.org/guide/8_6/configsets-api.html";>see docs</a>)</li>
-<li>Use Authentication/Authorization and make sure unknown requests aren't
allowed (<a
href="https://solr.apache.org/guide/8_6/authentication-and-authorization-plugins.html";>see
docs</a>)</li>
-<li>Upgrade to <code>Solr 8.6.3</code> or greater.</li>
-<li>If upgrading is not an option, consider applying the patch in <a
href="https://issues.apache.org/jira/browse/SOLR-14663";>SOLR-14663</a></li>
-<li>No Solr API, including the Admin UI, is designed to be exposed to
non-trusted parties. Tune your firewall so that only trusted computers and
people are allowed access</li>
-</ul>
-<p><strong>Credit:</strong>
-Tomás Fernández Löbbe, András Salamon</p>
-<p><strong>References:</strong>
-<a href="https://issues.apache.org/jira/browse/SOLR-14925";>SOLR-14925</a>:
CVE-2020-13957: The checks added to unauthenticated configset uploads can be
circumvented</p>
- <hr/>
<div class="pagination">
<span class="pagination-info">
diff --git a/output/security-news2.html b/output/security-news2.html
index 413b144d4..a7835f009 100644
--- a/output/security-news2.html
+++ b/output/security-news2.html
@@ -144,6 +144,31 @@
<h1 id="solr-security-news">Solr<sup>™</sup> Security News<a
class="headerlink" href="#solr-security-news" title="Permanent link">¶</a></h1>
<p>Full history of Apache Solr security advisories. Subscribe to the <a
href="/feeds/solr/security.atom.xml">security ATOM feed</a> to be notified of
new advisories.</p>
+ <h2
id="cve-2020-13957-the-checks-added-to-unauthenticated-configset-uploads-in-apache-solr-can-be-circumvented">2020-10-12,
CVE-2020-13957: The checks added to unauthenticated configset uploads in
Apache Solr can be circumvented
+ <a class="headerlink"
href="#cve-2020-13957-the-checks-added-to-unauthenticated-configset-uploads-in-apache-solr-can-be-circumvented"
title="Permanent link">¶</a>
+ </h2>
+ <p><strong>Severity:</strong>
+High</p>
+<p><strong>Versions Affected:</strong>
+6.6.0 to 6.6.6
+7.0.0 to 7.7.3
+8.0.0 to 8.6.2</p>
+<p><strong>Description:</strong>
+Solr prevents some features considered dangerous (which could be used for
remote code execution) to be configured in a ConfigSet that's uploaded via API
without authentication/authorization. The checks in place to prevent such
features can be circumvented by using a combination of UPLOAD/CREATE
actions.</p>
+<p><strong>Mitigation:</strong>
+Any of the following are enough to prevent this vulnerability:</p>
+<ul>
+<li>Disable UPLOAD command in ConfigSets API if not used by setting the system
property: <code>configset.upload.enabled</code> to <code>false</code> (<a
href="https://solr.apache.org/guide/8_6/configsets-api.html";>see docs</a>)</li>
+<li>Use Authentication/Authorization and make sure unknown requests aren't
allowed (<a
href="https://solr.apache.org/guide/8_6/authentication-and-authorization-plugins.html";>see
docs</a>)</li>
+<li>Upgrade to <code>Solr 8.6.3</code> or greater.</li>
+<li>If upgrading is not an option, consider applying the patch in <a
href="https://issues.apache.org/jira/browse/SOLR-14663";>SOLR-14663</a></li>
+<li>No Solr API, including the Admin UI, is designed to be exposed to
non-trusted parties. Tune your firewall so that only trusted computers and
people are allowed access</li>
+</ul>
+<p><strong>Credit:</strong>
+Tomás Fernández Löbbe, András Salamon</p>
+<p><strong>References:</strong>
+<a href="https://issues.apache.org/jira/browse/SOLR-14925";>SOLR-14925</a>:
CVE-2020-13957: The checks added to unauthenticated configset uploads can be
circumvented</p>
+ <hr/>
<h2
id="cve-2020-13941-apache-solr-information-disclosure-vulnerability">2020-08-14,
CVE-2020-13941: Apache Solr information disclosure vulnerability
<a class="headerlink"
href="#cve-2020-13941-apache-solr-information-disclosure-vulnerability"
title="Permanent link">¶</a>
</h2>
diff --git a/output/security.html b/output/security.html
index edf59fb71..a36b5e328 100644
--- a/output/security.html
+++ b/output/security.html
@@ -174,8 +174,8 @@ output, or references multiple dependencies at the same
time is likely to be ign
The large number of reports about already-known issues is a serious drag on
our volunteer time —
<strong>please search Jira</strong> before opening a new issue.</p>
- <h2 id="recent-cve-disclosures-for-apache-solr">Recent CVE Disclosures for
Apache Solr
- <a class="headerlink" href="#recent-cve-disclosures-for-apache-solr"
title="Permanent link">¶</a>
+ <h2 id="recent-security-advisories">Recent Security Advisories for Apache
Solr
+ <a class="headerlink" href="#recent-security-advisories" title="Permanent
link">¶</a>
</h2>
<p>The five most recent security advisories.</p>
@@ -185,6 +185,11 @@ The large number of reports about already-known issues is
a serious drag on our
<th width="95">Date</th>
<th>Announcement</th>
</tr>
+ <tr>
+ <td></td>
+ <td>2026-05-19</td>
+ <td><a
href="/security-news.html#jwt-authentication-blockunknown-default-allows-unauthenticated-access-contrary-to-documentation">JWT
Authentication: blockUnknown default allows unauthenticated access contrary to
documentation</a></td>
+ </tr>
<tr>
<td><a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-22022";>CVE-2026-22022</a></td>
<td>2026-01-20</td>
@@ -205,11 +210,6 @@ The large number of reports about already-known issues is
a serious drag on our
<td>2025-01-26</td>
<td><a
href="/security-news.html#cve-2024-52012-apache-solr-configset-upload-on-windows-allows-arbitrary-path-write-access">Apache
Solr: Configset upload on Windows allows arbitrary path write-access</a></td>
</tr>
- <tr>
- <td><a
href="https://nvd.nist.gov/vuln/detail/CVE-2025-24814";>CVE-2025-24814</a></td>
- <td>2025-01-26</td>
- <td><a
href="/security-news.html#cve-2025-24814-apache-solr-core-creation-with-trusted-configset-can-use-arbitrary-untrusted-files">Apache
Solr: Core-creation with "trusted" configset can use arbitrary untrusted
files</a></td>
- </tr>
</table>
<p><a href="/security-news.html">See full security news history →</a></p>
