This is an automated email from the ASF dual-hosted git repository.
github-actions[bot] pushed a commit to branch asf-staging
in repository https://gitbox.apache.org/repos/asf/solr-site.git
The following commit(s) were added to refs/heads/asf-staging by this push:
new da46f1956 Commit build products
da46f1956 is described below
commit da46f19560c3a5580770ff98e351d222f46af50d
Author: Build Pelican (action) <[email protected]>
AuthorDate: Fri Jul 31 17:15:16 2026 +0000
Commit build products
---
output/feeds/all.atom.xml | 26 ++--
output/feeds/solr/vex.atom.xml | 17 ++-
output/security-dependency-cves.html | 27 ++++
output/solr.openvex.json | 102 ++++++++++++++
output/solr.vex.json | 264 ++++++++++++++++++++++-------------
output/vex.html | 73 ++++++++++
6 files changed, 399 insertions(+), 110 deletions(-)
diff --git a/output/feeds/all.atom.xml b/output/feeds/all.atom.xml
index 1fa28783d..9c7f15b26 100644
--- a/output/feeds/all.atom.xml
+++ b/output/feeds/all.atom.xml
@@ -1,5 +1,14 @@
<?xml version="1.0" encoding="utf-8"?>
-<feed xmlns="http://www.w3.org/2005/Atom";><title>Apache Solr</title><link
href="/" rel="alternate"/><link href="/feeds/all.atom.xml"
rel="self"/><id>/</id><updated>2026-07-18T00:00:00+00:00</updated><entry><title>Netty:
HTTP request smuggling via setUri() CRLF-validation bypass</title><link
href="/cve-2026-41417.html"
rel="alternate"/><published>2026-07-18T00:00:00+00:00</published><updated>2026-07-18T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026- [...]
+<feed xmlns="http://www.w3.org/2005/Atom";><title>Apache Solr</title><link
href="/" rel="alternate"/><link href="/feeds/all.atom.xml"
rel="self"/><id>/</id><updated>2026-07-18T00:00:00+00:00</updated><entry><title>Apache
Commons BeanUtils: class-loader access via a 'declaredClass' property
path</title><link href="/cve-2025-48734.html"
rel="alternate"/><published>2026-07-18T00:00:00+00:00</published><updated>2026-07-18T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><i [...]
+<p>CVE-2025-48734 affects all Commons BeanUtils 1.x releases before
1.11.0. Solr has bundled
+commons-beanutils since Solr 3.6.0, and every release that includes it,
through Solr 10.0.0, ships an
+affected 1.x version (1.7.0, then 1.8.3, 1.9.3 and 1.9.4 — all below 1.11.0).
The affected range is
+therefore 3.6.0 – 10.0.0.</p></content><category
term="solr/vex"/></entry><entry><title>Netty: HTTP/1.1 request smuggling and
HTTP/2 CONTINUATION-flood DoS (server-side codec)</title><link
href="/cve-2026-33870.html"
rel="alternate"/><published>2026-07-18T00:00:00+00:00</published><updated>2026-07-18T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-07-18:/cve-2026-33870.html</id><summary
type="html"><p>CVE-2026-33870 is an HTTP/1.1 reques [...]
+<p>Both CVEs affect Netty releases before 4.1.132 and 4.2.0 through
4.2.9. Solr has bundled the modular
+<code>netty-codec-http</code> /
<code>netty-codec-http2</code> artifacts (transitively, via
ZooKeeper and the optional
+OpenTelemetry OTLP exporter) since Solr 9.2.0 — earlier releases used the
<code>netty-all</code> uber-jar — and
+every release from 9.2.0 through 10.0.0 ships an affected version
(4.1.89.Final through 4.2.6.Final).
+The affected range is therefore 9.2.0 – 10.0.0.</p></content><category
term="solr/vex"/></entry><entry><title>Netty: HTTP request smuggling via
setUri() CRLF-validation bypass</title><link href="/cve-2026-41417.html"
rel="alternate"/><published>2026-07-18T00:00:00+00:00</published><updated>2026-07-18T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-07-18:/cve-2026-41417.html</id><summary
type="html"><p>CVE-2026-41417 (CVSS 5.3) is a reque [...]
codec. <code>DefaultHttpRequest</code> and
<code>DefaultFullHttpRequest</code> reject CRLF and whitespace
characters in
their constructors, but the <code>setUri()</code> method that lets
a request's URI be rewritten after
construction has no equivalent validation, so an attacker who controls a
…</p></summary><content type="html"><p>CVE-2026-41417 (CVSS 5.3) is
a request-smuggling issue (CWE-93 / CWE-444) in Netty's HTTP/1.1
@@ -622,7 +631,11 @@ Solr is <strong>not
affected</strong>:</p>
on the classpath but not reachable in any real Solr deployment.</p>
<p>No released Solr version ships the fix. The fixed Netty
(4.2.15.Final) is already present on the
<code>branch_9x</code> (→ 9.11.0) and
<code>branch_10x</code> (→ 10.1.0) development branches, but hasn't
reached a
-released line yet.</p></content><category
term="solr/vex"/></entry><entry><title>Eclipse Jetty: differential URI parsing
can bypass front-end URI controls</title><link href="/cve-2025-11143.html"
rel="alternate"/><published>2026-06-18T00:00:00+00:00</published><updated>2026-06-18T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-06-18:/cve-2025-11143.html</id><summary
type="html"><p>CVE-2025-11143 (CVSS 6.5; 3.7 per the Eclipse Foundation)
[...]
+released line yet.</p></content><category
term="solr/vex"/></entry><entry><title>Jackson-core: async (non-blocking)
parser bypasses maxNumberLength (DoS)</title><link
href="/ghsa-72hv-8253-57qq.html"
rel="alternate"/><published>2026-07-18T00:00:00+00:00</published><updated>2026-07-18T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-07-18:/ghsa-72hv-8253-57qq.html</id><summary
type="html"><p>GHSA-72hv-8253-57qq is a DoS vulnerability in th [...]
+<p>GHSA-72hv-8253-57qq affects jackson-core releases before 2.18.6 and
the 2.19.0 through 2.21.0 line
+(fixed in 2.18.6 and 2.21.1). Solr has bundled jackson-core (alongside
<code>jackson-databind</code>, which it
+ships in lockstep with) since Solr 4.7.0, and every release through 10.0.0
ships an affected version
+(2.3.1 through 2.18.0, then 2.20.0). The affected range is therefore 4.7.0 –
10.0.0.</p></content><category
term="solr/vex"/></entry><entry><title>Eclipse Jetty: differential URI parsing
can bypass front-end URI controls</title><link href="/cve-2025-11143.html"
rel="alternate"/><published>2026-06-18T00:00:00+00:00</published><updated>2026-06-18T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-06-18:/cve-2025-11143.html</id><summary
type="html"> [...]
(CWE-20) in Eclipse Jetty's URI parser (<code>HttpURI</code>): it
interprets some invalid or unusual URIs
differently from other common HTTP parsers. When a component in front of Jetty
parses the same URI
differently, an attacker can craft …</p></summary><content
type="html"><p>CVE-2025-11143 (CVSS 6.5; 3.7 per the Eclipse Foundation)
is an improper-input-validation issue
@@ -2030,11 +2043,4 @@ ship any Struts jar — the dependency is excluded and
only appears as a transit
transitive dependency on <code>struts-core</code>,
<code>struts-taglib</code> and
<code>struts-tiles</code> 1.3.8. Solr does not
ship any Struts jar — the dependency is excluded and only appears as a
transitive POM listing
(see SOLR-2849) — so these Struts vulnerabilities are not present in, or
exploitable through, Solr.</p></content><category
term="solr/vex"/></entry><entry><title>vorbis-java-tika</title><link
href="/cve-2016-6809.html"
rel="alternate"/><published>2022-12-14T00:00:00+00:00</published><updated>2022-12-14T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2022-12-14:/cve-2016-6809.html</id><content
type="html"><p>See https://github.com/Gagravarr/Vo [...]
-<p>Tika as an in-process component was removed in Solr
9.11.</p></content><category
term="solr/vex"/></entry><entry><title>org.restlet</title><link
href="/cve-2017-14868.html"
rel="alternate"/><published>2022-12-14T00:00:00+00:00</published><updated>2022-12-14T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2022-12-14:/cve-2017-14868.html</id><content
type="html"><p>Solr should not be exposed outside a firewall where bad
actors can send [...]
-releases up to and including 2.0.6 (fixed in 2.0.6.1). Solr has bundled JDOM
(transitively, via
-Apache Tika / Solr Cell) since Solr 3.6.0 — <code>jdom</code> 1.0,
then <code>jdom</code> 2.0 …</p></summary><content
type="html"><p>CVE-2021-33813 is an XML external entity (XXE) issue in
JDOM's <code>SAXBuilder</code>, affecting all JDOM
-releases up to and including 2.0.6 (fixed in 2.0.6.1). Solr has bundled JDOM
(transitively, via
-Apache Tika / Solr Cell) since Solr 3.6.0 — <code>jdom</code> 1.0,
then <code>jdom</code> 2.0.2, then <code>jdom2</code>
2.0.6 —
-through the last 8.x release; Solr 9.0.0 upgraded to the fixed
<code>jdom2</code> 2.0.6.1. The affected range is
-therefore 3.6.0 – 8.8.1.</p>
-<p>JDOM is only used in Solr Cell, which should not be used in
production which makes the vulnerability unexploitable. It is a dependency of
Apache Tika, which has analyzed the issue and determined the vulnerability is
limited to two libraries not commonly used in search applications, see
TIKA-3488 for details. Since Tika should be used outside of Solr, use a version
of Tika which updates the affected libraries if concerned about exposure to
this issue.</p></content><category [...]
\ No newline at end of file
+<p>Tika as an in-process component was removed in Solr
9.11.</p></content><category
term="solr/vex"/></entry><entry><title>org.restlet</title><link
href="/cve-2017-14868.html"
rel="alternate"/><published>2022-12-14T00:00:00+00:00</published><updated>2022-12-14T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2022-12-14:/cve-2017-14868.html</id><content
type="html"><p>Solr should not be exposed outside a firewall where bad
actors can send [...]
\ No newline at end of file
diff --git a/output/feeds/solr/vex.atom.xml b/output/feeds/solr/vex.atom.xml
index 4394b881f..012843dab 100644
--- a/output/feeds/solr/vex.atom.xml
+++ b/output/feeds/solr/vex.atom.xml
@@ -1,5 +1,14 @@
<?xml version="1.0" encoding="utf-8"?>
-<feed xmlns="http://www.w3.org/2005/Atom";><title>Apache Solr -
solr/vex</title><link href="/" rel="alternate"/><link
href="/feeds/solr/vex.atom.xml"
rel="self"/><id>/</id><updated>2026-07-18T00:00:00+00:00</updated><entry><title>Netty:
HTTP request smuggling via setUri() CRLF-validation bypass</title><link
href="/cve-2026-41417.html"
rel="alternate"/><published>2026-07-18T00:00:00+00:00</published><updated>2026-07-18T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><i [...]
+<feed xmlns="http://www.w3.org/2005/Atom";><title>Apache Solr -
solr/vex</title><link href="/" rel="alternate"/><link
href="/feeds/solr/vex.atom.xml"
rel="self"/><id>/</id><updated>2026-07-18T00:00:00+00:00</updated><entry><title>Apache
Commons BeanUtils: class-loader access via a 'declaredClass' property
path</title><link href="/cve-2025-48734.html"
rel="alternate"/><published>2026-07-18T00:00:00+00:00</published><updated>2026-07-18T00:00:00+00:00</updated><author><name>Solr
Developers</ [...]
+<p>CVE-2025-48734 affects all Commons BeanUtils 1.x releases before
1.11.0. Solr has bundled
+commons-beanutils since Solr 3.6.0, and every release that includes it,
through Solr 10.0.0, ships an
+affected 1.x version (1.7.0, then 1.8.3, 1.9.3 and 1.9.4 — all below 1.11.0).
The affected range is
+therefore 3.6.0 – 10.0.0.</p></content><category
term="solr/vex"/></entry><entry><title>Netty: HTTP/1.1 request smuggling and
HTTP/2 CONTINUATION-flood DoS (server-side codec)</title><link
href="/cve-2026-33870.html"
rel="alternate"/><published>2026-07-18T00:00:00+00:00</published><updated>2026-07-18T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-07-18:/cve-2026-33870.html</id><summary
type="html"><p>CVE-2026-33870 is an HTTP/1.1 reques [...]
+<p>Both CVEs affect Netty releases before 4.1.132 and 4.2.0 through
4.2.9. Solr has bundled the modular
+<code>netty-codec-http</code> /
<code>netty-codec-http2</code> artifacts (transitively, via
ZooKeeper and the optional
+OpenTelemetry OTLP exporter) since Solr 9.2.0 — earlier releases used the
<code>netty-all</code> uber-jar — and
+every release from 9.2.0 through 10.0.0 ships an affected version
(4.1.89.Final through 4.2.6.Final).
+The affected range is therefore 9.2.0 – 10.0.0.</p></content><category
term="solr/vex"/></entry><entry><title>Netty: HTTP request smuggling via
setUri() CRLF-validation bypass</title><link href="/cve-2026-41417.html"
rel="alternate"/><published>2026-07-18T00:00:00+00:00</published><updated>2026-07-18T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-07-18:/cve-2026-41417.html</id><summary
type="html"><p>CVE-2026-41417 (CVSS 5.3) is a reque [...]
codec. <code>DefaultHttpRequest</code> and
<code>DefaultFullHttpRequest</code> reject CRLF and whitespace
characters in
their constructors, but the <code>setUri()</code> method that lets
a request's URI be rewritten after
construction has no equivalent validation, so an attacker who controls a
…</p></summary><content type="html"><p>CVE-2026-41417 (CVSS 5.3) is
a request-smuggling issue (CWE-93 / CWE-444) in Netty's HTTP/1.1
@@ -622,7 +631,11 @@ Solr is <strong>not
affected</strong>:</p>
on the classpath but not reachable in any real Solr deployment.</p>
<p>No released Solr version ships the fix. The fixed Netty
(4.2.15.Final) is already present on the
<code>branch_9x</code> (→ 9.11.0) and
<code>branch_10x</code> (→ 10.1.0) development branches, but hasn't
reached a
-released line yet.</p></content><category
term="solr/vex"/></entry><entry><title>Eclipse Jetty: differential URI parsing
can bypass front-end URI controls</title><link href="/cve-2025-11143.html"
rel="alternate"/><published>2026-06-18T00:00:00+00:00</published><updated>2026-06-18T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-06-18:/cve-2025-11143.html</id><summary
type="html"><p>CVE-2025-11143 (CVSS 6.5; 3.7 per the Eclipse Foundation)
[...]
+released line yet.</p></content><category
term="solr/vex"/></entry><entry><title>Jackson-core: async (non-blocking)
parser bypasses maxNumberLength (DoS)</title><link
href="/ghsa-72hv-8253-57qq.html"
rel="alternate"/><published>2026-07-18T00:00:00+00:00</published><updated>2026-07-18T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-07-18:/ghsa-72hv-8253-57qq.html</id><summary
type="html"><p>GHSA-72hv-8253-57qq is a DoS vulnerability in th [...]
+<p>GHSA-72hv-8253-57qq affects jackson-core releases before 2.18.6 and
the 2.19.0 through 2.21.0 line
+(fixed in 2.18.6 and 2.21.1). Solr has bundled jackson-core (alongside
<code>jackson-databind</code>, which it
+ships in lockstep with) since Solr 4.7.0, and every release through 10.0.0
ships an affected version
+(2.3.1 through 2.18.0, then 2.20.0). The affected range is therefore 4.7.0 –
10.0.0.</p></content><category
term="solr/vex"/></entry><entry><title>Eclipse Jetty: differential URI parsing
can bypass front-end URI controls</title><link href="/cve-2025-11143.html"
rel="alternate"/><published>2026-06-18T00:00:00+00:00</published><updated>2026-06-18T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-06-18:/cve-2025-11143.html</id><summary
type="html"> [...]
(CWE-20) in Eclipse Jetty's URI parser (<code>HttpURI</code>): it
interprets some invalid or unusual URIs
differently from other common HTTP parsers. When a component in front of Jetty
parses the same URI
differently, an attacker can craft …</p></summary><content
type="html"><p>CVE-2025-11143 (CVSS 6.5; 3.7 per the Eclipse Foundation)
is an improper-input-validation issue
diff --git a/output/security-dependency-cves.html
b/output/security-dependency-cves.html
index 79aa9b340..fd7863e78 100644
--- a/output/security-dependency-cves.html
+++ b/output/security-dependency-cves.html
@@ -191,6 +191,15 @@ or contact <a
href="mailto:[email protected]";>[email protected]</a>.</p>
</tr>
<tr>
<td>
+<a
href="https://github.com/advisories/GHSA-72hv-8253-57qq";>GHSA-72hv-8253-57qq</a>
</td>
+ <td>4.7.0-10.0.0</td>
+ <td>
+ jackson-core-2.20.0.jar </td>
+ <td><span class="cdx-not-affected">not affected</span></td>
+ <td><a href="/vex.html#ghsa-72hv-8253-57qq">Jackson-core: async
(non-blocking) parser bypasses maxNumberLength (DoS)</a></td>
+ </tr>
+ <tr>
+ <td>
<a href="https://nvd.nist.gov/vuln/detail/CVE-2026-50560";>CVE-2026-50560</a>
</td>
<td>9.2.0-9.10.x,10.0.x</td>
<td>
@@ -344,6 +353,24 @@ or contact <a
href="mailto:[email protected]";>[email protected]</a>.</p>
</tr>
<tr>
<td>
+<a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33870";>CVE-2026-33870</a>,
<a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33871";>CVE-2026-33871</a>
</td>
+ <td>9.2.0-10.0.0</td>
+ <td>
+ netty-codec-http-4.2.6.Final.jar,
netty-codec-http2-4.2.6.Final.jar </td>
+ <td><span class="cdx-not-affected">not affected</span></td>
+ <td><a href="/vex.html#cve-2026-33870">Netty: HTTP/1.1 request smuggling
and HTTP/2 CONTINUATION-flood DoS (server-side codec)</a></td>
+ </tr>
+ <tr>
+ <td>
+<a href="https://nvd.nist.gov/vuln/detail/CVE-2025-48734";>CVE-2025-48734</a>
</td>
+ <td>3.6.0-10.0.0</td>
+ <td>
+ commons-beanutils-1.9.4.jar </td>
+ <td><span class="cdx-not-affected">not affected</span></td>
+ <td><a href="/vex.html#cve-2025-48734">Apache Commons BeanUtils:
class-loader access via a 'declaredClass' property path</a></td>
+ </tr>
+ <tr>
+ <td>
<a href="https://nvd.nist.gov/vuln/detail/CVE-2026-5795";>CVE-2026-5795</a>
</td>
<td>7.3.0-10.0.0</td>
<td>
diff --git a/output/solr.openvex.json b/output/solr.openvex.json
index 9a5e5718b..a055f5a33 100644
--- a/output/solr.openvex.json
+++ b/output/solr.openvex.json
@@ -1436,6 +1436,93 @@
"impact_statement": "CVE-2026-5795 (CVSS 7.4) is a broken-access-control
/ privilege-escalation issue in Eclipse Jetty's\n`JASPIAuthenticator` (the
JSR-196 / Jakarta Authentication \"JASPI\" integration). During
an\nauthentication check it sets thread-local state and, on an early return,
fails to clear it, so a\nsubsequent request served by the same pooled thread
can inherit that authentication state. It\naffects Jetty 9.4.0\u20139.4.60,
10.0.0\u201310.0.28, 11.0.0\u201311.0.28, 12 [...]
"status_notes": "Affected Apache Solr versions: 7.3.0-10.0.0."
},
+ {
+ "vulnerability": {
+ "name": "CVE-2025-48734"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/commons-beanutils/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/commons-beanutils/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/commons-beanutils/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/commons-beanutils/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-07-18T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "CVE-2025-48734 allows an attacker to access the JVM
ClassLoader (and potentially execute arbitrary code) by passing a property path
containing 'declaredClass' to PropertyUtilsBean.getProperty() or
getNestedProperty(). Exploitation requires an application to pass externally
supplied property path strings to these BeanUtils methods. A search of the Solr
codebase confirms that Solr does not call PropertyUtilsBean.getProperty(),
BeanUtilsBean, or any Commons BeanUt [...]
+ "status_notes": "Affected Apache Solr versions: 3.6.0-10.0.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2026-33870",
+ "aliases": [
+ "CVE-2026-33871"
+ ]
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-07-18T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "CVE-2026-33870 is an HTTP/1.1 request smuggling
vulnerability via malformed chunked transfer encoding extension values in
Netty's server-side HTTP codec. CVE-2026-33871 is an HTTP/2 CONTINUATION frame
flood DoS against a Netty HTTP/2 server. Both require Netty to be used as an
HTTP server accepting connections from untrusted clients. In Solr, Netty is a
transitive dependency (via ZooKeeper 3.9.x and optionally the OpenTelemetry
OTLP exporter); it is used exclus [...]
+ "status_notes": "Affected Apache Solr versions: 9.2.0-10.0.0."
+ },
{
"vulnerability": {
"name": "CVE-2026-41417"
@@ -2074,6 +2161,21 @@
"justification": "vulnerable_code_not_in_execute_path",
"impact_statement": "CVE-2026-50560 (CVSS 5.3, CWE-770) is a
resource-exhaustion issue in `netty-codec-http2`, in the\nsame \"HTTP/2 Rapid
Reset\" family of attacks as the 2023 stream-reset issue (CVE-2023-44487)
but\nwith a different trigger: a client that advertises
`SETTINGS_MAX_HEADER_LIST_SIZE` can cause the\nserver to read a request, start
proxying/processing it, attempt to generate a response, and then\nthrow an
exception while writing the response headers \u2014 repeating t [...]
"status_notes": "Affected Apache Solr versions: 9.2.0-9.10.x,10.0.x."
+ },
+ {
+ "vulnerability": {
+ "name": "GHSA-72hv-8253-57qq"
+ },
+ "products": [
+ {
+ "@id": "jackson-core-2.20.0.jar"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-07-18T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "GHSA-72hv-8253-57qq is a DoS vulnerability in the
non-blocking (async) JSON parser API of jackson-core
(NonBlockingByteArrayJsonParser), which bypasses the maxNumberLength
constraint. Exploitation requires an application to use the async/non-blocking
parser API (factory.createNonBlockingByteArrayParser()). Solr uses the standard
synchronous Jackson parser to deserialize JSON from HTTP request bodies and
internal data structures. Solr is built on Jetty with sync [...]
+ "status_notes": "Affected Apache Solr versions: 4.7.0-10.0.0."
}
]
}
\ No newline at end of file
diff --git a/output/solr.vex.json b/output/solr.vex.json
index 429583b92..534f3f121 100644
--- a/output/solr.vex.json
+++ b/output/solr.vex.json
@@ -7,7 +7,7 @@
"name": "solr",
"version": "SNAPSHOT",
"type": "application",
- "bom-ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "bom-ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
},
"vulnerabilities": [
@@ -23,7 +23,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -39,7 +39,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -55,7 +55,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -71,7 +71,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -87,7 +87,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -103,7 +103,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -119,7 +119,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -135,7 +135,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -151,7 +151,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -167,7 +167,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -183,7 +183,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -199,7 +199,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -215,7 +215,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -231,7 +231,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -247,7 +247,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -263,7 +263,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -279,7 +279,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -295,7 +295,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -311,7 +311,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -327,7 +327,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -343,7 +343,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -359,7 +359,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -375,7 +375,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -391,7 +391,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -407,7 +407,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -423,7 +423,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -439,7 +439,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -455,7 +455,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -471,7 +471,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -487,7 +487,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -503,7 +503,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -519,7 +519,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -535,7 +535,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -551,7 +551,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -567,7 +567,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -583,7 +583,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -599,7 +599,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -615,7 +615,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -631,7 +631,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -647,7 +647,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -663,7 +663,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -679,7 +679,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -695,7 +695,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -711,7 +711,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -727,7 +727,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -743,7 +743,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -759,7 +759,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -775,7 +775,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -791,7 +791,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -807,7 +807,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -823,7 +823,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -839,7 +839,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -855,7 +855,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -871,7 +871,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -887,7 +887,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -903,7 +903,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -919,7 +919,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -935,7 +935,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -951,7 +951,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -970,7 +970,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -986,7 +986,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1002,7 +1002,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1018,7 +1018,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1037,7 +1037,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1053,7 +1053,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1070,7 +1070,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1086,7 +1086,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1103,7 +1103,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1120,7 +1120,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1137,7 +1137,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1154,7 +1154,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1171,7 +1171,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1188,7 +1188,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1208,7 +1208,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1228,7 +1228,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1248,7 +1248,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1265,7 +1265,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1285,7 +1285,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1302,7 +1302,58 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
+ }
+ ]
+ },
+ {
+ "id": "CVE-2025-48734",
+ "source": {
+ "name": "NVD",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48734";
+ },
+ "analysis": {
+ "state": "not_affected",
+ "justification": "code_not_reachable",
+ "detail": "CVE-2025-48734 allows an attacker to access the JVM
ClassLoader (and potentially execute arbitrary code) by passing a property path
containing 'declaredClass' to PropertyUtilsBean.getProperty() or
getNestedProperty(). Exploitation requires an application to pass externally
supplied property path strings to these BeanUtils methods. A search of the Solr
codebase confirms that Solr does not call PropertyUtilsBean.getProperty(),
BeanUtilsBean, or any Commons BeanUtils intr [...]
+ },
+ "affects": [
+ {
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
+ }
+ ]
+ },
+ {
+ "id": "CVE-2026-33870",
+ "source": {
+ "name": "NVD",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33870";
+ },
+ "analysis": {
+ "state": "not_affected",
+ "justification": "code_not_reachable",
+ "detail": "CVE-2026-33870 is an HTTP/1.1 request smuggling
vulnerability via malformed chunked transfer encoding extension values in
Netty's server-side HTTP codec. CVE-2026-33871 is an HTTP/2 CONTINUATION frame
flood DoS against a Netty HTTP/2 server. Both require Netty to be used as an
HTTP server accepting connections from untrusted clients. In Solr, Netty is a
transitive dependency (via ZooKeeper 3.9.x and optionally the OpenTelemetry
OTLP exporter); it is used exclusively as [...]
+ },
+ "affects": [
+ {
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
+ }
+ ]
+ },
+ {
+ "id": "CVE-2026-33871",
+ "source": {
+ "name": "NVD",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33871";
+ },
+ "analysis": {
+ "state": "not_affected",
+ "justification": "code_not_reachable",
+ "detail": "CVE-2026-33870 is an HTTP/1.1 request smuggling
vulnerability via malformed chunked transfer encoding extension values in
Netty's server-side HTTP codec. CVE-2026-33871 is an HTTP/2 CONTINUATION frame
flood DoS against a Netty HTTP/2 server. Both require Netty to be used as an
HTTP server accepting connections from untrusted clients. In Solr, Netty is a
transitive dependency (via ZooKeeper 3.9.x and optionally the OpenTelemetry
OTLP exporter); it is used exclusively as [...]
+ },
+ "affects": [
+ {
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1319,7 +1370,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1336,7 +1387,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1353,7 +1404,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1370,7 +1421,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1387,7 +1438,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1404,7 +1455,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1421,7 +1472,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1438,7 +1489,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1455,7 +1506,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1472,7 +1523,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1489,7 +1540,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1506,7 +1557,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1523,7 +1574,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1540,7 +1591,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1557,7 +1608,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1574,7 +1625,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1591,7 +1642,7 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1608,7 +1659,24 @@
},
"affects": [
{
- "ref": "250a2d1a-900a-5e36-b772-c6dcaf68469c"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
+ }
+ ]
+ },
+ {
+ "id": "GHSA-72hv-8253-57qq",
+ "source": {
+ "name": "GITHUB",
+ "url": "https://github.com/advisories/GHSA-72hv-8253-57qq";
+ },
+ "analysis": {
+ "state": "not_affected",
+ "justification": "code_not_reachable",
+ "detail": "GHSA-72hv-8253-57qq is a DoS vulnerability in the
non-blocking (async) JSON parser API of jackson-core
(NonBlockingByteArrayJsonParser), which bypasses the maxNumberLength
constraint. Exploitation requires an application to use the async/non-blocking
parser API (factory.createNonBlockingByteArrayParser()). Solr uses the standard
synchronous Jackson parser to deserialize JSON from HTTP request bodies and
internal data structures. Solr is built on Jetty with synchronous [...]
+ },
+ "affects": [
+ {
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
}
diff --git a/output/vex.html b/output/vex.html
index 938c5f875..ab798510d 100644
--- a/output/vex.html
+++ b/output/vex.html
@@ -142,6 +142,30 @@
<h1>Apache Solr VEX</h1>
<p><a href="/security-dependency-cves.html">← Back to the dependency
CVE table</a></p>
+ <article id="ghsa-72hv-8253-57qq" class="post panel radius">
+ <header class="post-header">
+ <h3 class="title"><a
href="https://github.com/advisories/GHSA-72hv-8253-57qq";>GHSA-72hv-8253-57qq</a>,
Jackson-core: async (non-blocking) parser bypasses maxNumberLength (DoS)</h3>
+ <div class="panel callout">
+ <p class="subheader">
+ <strong>Status:</strong>
+ <span class="cdx-not-affected">not_affected</span>
+ </p>
+ <p class="subheader"><strong>Affected Solr
versions:</strong> 4.7.0-10.0.0</p>
+ </div>
+ </header>
+
+ <h4>Description</h4>
+ <p>GHSA-72hv-8253-57qq is a DoS vulnerability in the
non-blocking (async) JSON parser API of jackson-core
(NonBlockingByteArrayJsonParser), which bypasses the maxNumberLength
constraint. Exploitation requires an application to use the async/non-blocking
parser API (factory.createNonBlockingByteArrayParser()). Solr uses the standard
synchronous Jackson parser to deserialize JSON from HTTP request bodies and
internal data structures. Solr is built on Jetty with synchronous [...]
+<p>GHSA-72hv-8253-57qq affects jackson-core releases before 2.18.6 and the
2.19.0 through 2.21.0 line
+(fixed in 2.18.6 and 2.21.1). Solr has bundled jackson-core (alongside
<code>jackson-databind</code>, which it
+ships in lockstep with) since Solr 4.7.0, and every release through 10.0.0
ships an affected version
+(2.3.1 through 2.18.0, then 2.20.0). The affected range is therefore 4.7.0 –
10.0.0.</p>
+
+ <h4>References</h4>
+ <ul>
+ <li>CVE: <a
href="https://github.com/advisories/GHSA-72hv-8253-57qq";>GHSA-72hv-8253-57qq</a></li>
+ </ul>
+ </article>
<article id="cve-2026-50560" class="post panel radius">
<header class="post-header">
<h3 class="title"><a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-50560";>CVE-2026-50560</a>,
Netty: HTTP/2 max-header-size handling enables Rapid-Reset-style DoS</h3>
@@ -1065,6 +1089,55 @@ fixed — and will be released in Solr versions 9.11.0 and
10.1.</p>
<li>CVE: <a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-41417";>CVE-2026-41417</a></li>
</ul>
</article>
+ <article id="cve-2026-33870" class="post panel radius">
+ <header class="post-header">
+ <h3 class="title"><a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-33870";>CVE-2026-33870</a>, <a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-33871";>CVE-2026-33871</a>,
Netty: HTTP/1.1 request smuggling and HTTP/2 CONTINUATION-flood DoS
(server-side codec)</h3>
+ <div class="panel callout">
+ <p class="subheader">
+ <strong>Status:</strong>
+ <span class="cdx-not-affected">not_affected</span>
+ </p>
+ <p class="subheader"><strong>Affected Solr
versions:</strong> 9.2.0-10.0.0</p>
+ </div>
+ </header>
+
+ <h4>Description</h4>
+ <p>CVE-2026-33870 is an HTTP/1.1 request smuggling
vulnerability via malformed chunked transfer encoding extension values in
Netty's server-side HTTP codec. CVE-2026-33871 is an HTTP/2 CONTINUATION frame
flood DoS against a Netty HTTP/2 server. Both require Netty to be used as an
HTTP server accepting connections from untrusted clients. In Solr, Netty is a
transitive dependency (via ZooKeeper 3.9.x and optionally the OpenTelemetry
OTLP exporter); it is used exclusively as [...]
+<p>Both CVEs affect Netty releases before 4.1.132 and 4.2.0 through 4.2.9.
Solr has bundled the modular
+<code>netty-codec-http</code> / <code>netty-codec-http2</code> artifacts
(transitively, via ZooKeeper and the optional
+OpenTelemetry OTLP exporter) since Solr 9.2.0 — earlier releases used the
<code>netty-all</code> uber-jar — and
+every release from 9.2.0 through 10.0.0 ships an affected version
(4.1.89.Final through 4.2.6.Final).
+The affected range is therefore 9.2.0 – 10.0.0.</p>
+
+ <h4>References</h4>
+ <ul>
+ <li>CVE: <a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-33870";>CVE-2026-33870</a>, <a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-33871";>CVE-2026-33871</a></li>
+ </ul>
+ </article>
+ <article id="cve-2025-48734" class="post panel radius">
+ <header class="post-header">
+ <h3 class="title"><a
href="https://nvd.nist.gov/vuln/detail/CVE-2025-48734";>CVE-2025-48734</a>,
Apache Commons BeanUtils: class-loader access via a 'declaredClass' property
path</h3>
+ <div class="panel callout">
+ <p class="subheader">
+ <strong>Status:</strong>
+ <span class="cdx-not-affected">not_affected</span>
+ </p>
+ <p class="subheader"><strong>Affected Solr
versions:</strong> 3.6.0-10.0.0</p>
+ </div>
+ </header>
+
+ <h4>Description</h4>
+ <p>CVE-2025-48734 allows an attacker to access the JVM
ClassLoader (and potentially execute arbitrary code) by passing a property path
containing 'declaredClass' to PropertyUtilsBean.getProperty() or
getNestedProperty(). Exploitation requires an application to pass externally
supplied property path strings to these BeanUtils methods. A search of the Solr
codebase confirms that Solr does not call PropertyUtilsBean.getProperty(),
BeanUtilsBean, or any Commons BeanUtils intr [...]
+<p>CVE-2025-48734 affects all Commons BeanUtils 1.x releases before 1.11.0.
Solr has bundled
+commons-beanutils since Solr 3.6.0, and every release that includes it,
through Solr 10.0.0, ships an
+affected 1.x version (1.7.0, then 1.8.3, 1.9.3 and 1.9.4 — all below 1.11.0).
The affected range is
+therefore 3.6.0 – 10.0.0.</p>
+
+ <h4>References</h4>
+ <ul>
+ <li>CVE: <a
href="https://nvd.nist.gov/vuln/detail/CVE-2025-48734";>CVE-2025-48734</a></li>
+ </ul>
+ </article>
<article id="cve-2026-5795" class="post panel radius">
<header class="post-header">
<h3 class="title"><a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-5795";>CVE-2026-5795</a>,
Eclipse Jetty: privilege escalation via uncleared JASPI ThreadLocals</h3>
