This is an automated email from the ASF dual-hosted git repository.
github-actions[bot] pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/solr-site.git
The following commit(s) were added to refs/heads/asf-site by this push:
new 3f41a5637 Commit build products
3f41a5637 is described below
commit 3f41a56373f6c780c24f2e11e06b187c106a5304
Author: Build Pelican (action) <[email protected]>
AuthorDate: Wed Aug 5 14:09:53 2026 +0000
Commit build products
---
output/feeds/all.atom.xml | 26 +-
output/feeds/solr/vex.atom.xml | 17 +-
output/security-dependency-cves.html | 42 +-
output/solr.openvex.json | 2181 ++++++++++++++++++++++++++++++++++
output/solr.vex.json | 264 ++--
output/vex.html | 73 ++
6 files changed, 2491 insertions(+), 112 deletions(-)
diff --git a/output/feeds/all.atom.xml b/output/feeds/all.atom.xml
index 1fa28783d..9c7f15b26 100644
--- a/output/feeds/all.atom.xml
+++ b/output/feeds/all.atom.xml
@@ -1,5 +1,14 @@
<?xml version="1.0" encoding="utf-8"?>
-<feed xmlns="http://www.w3.org/2005/Atom";><title>Apache Solr</title><link
href="/" rel="alternate"/><link href="/feeds/all.atom.xml"
rel="self"/><id>/</id><updated>2026-07-18T00:00:00+00:00</updated><entry><title>Netty:
HTTP request smuggling via setUri() CRLF-validation bypass</title><link
href="/cve-2026-41417.html"
rel="alternate"/><published>2026-07-18T00:00:00+00:00</published><updated>2026-07-18T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026- [...]
+<feed xmlns="http://www.w3.org/2005/Atom";><title>Apache Solr</title><link
href="/" rel="alternate"/><link href="/feeds/all.atom.xml"
rel="self"/><id>/</id><updated>2026-07-18T00:00:00+00:00</updated><entry><title>Apache
Commons BeanUtils: class-loader access via a 'declaredClass' property
path</title><link href="/cve-2025-48734.html"
rel="alternate"/><published>2026-07-18T00:00:00+00:00</published><updated>2026-07-18T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><i [...]
+<p>CVE-2025-48734 affects all Commons BeanUtils 1.x releases before
1.11.0. Solr has bundled
+commons-beanutils since Solr 3.6.0, and every release that includes it,
through Solr 10.0.0, ships an
+affected 1.x version (1.7.0, then 1.8.3, 1.9.3 and 1.9.4 — all below 1.11.0).
The affected range is
+therefore 3.6.0 – 10.0.0.</p></content><category
term="solr/vex"/></entry><entry><title>Netty: HTTP/1.1 request smuggling and
HTTP/2 CONTINUATION-flood DoS (server-side codec)</title><link
href="/cve-2026-33870.html"
rel="alternate"/><published>2026-07-18T00:00:00+00:00</published><updated>2026-07-18T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-07-18:/cve-2026-33870.html</id><summary
type="html"><p>CVE-2026-33870 is an HTTP/1.1 reques [...]
+<p>Both CVEs affect Netty releases before 4.1.132 and 4.2.0 through
4.2.9. Solr has bundled the modular
+<code>netty-codec-http</code> /
<code>netty-codec-http2</code> artifacts (transitively, via
ZooKeeper and the optional
+OpenTelemetry OTLP exporter) since Solr 9.2.0 — earlier releases used the
<code>netty-all</code> uber-jar — and
+every release from 9.2.0 through 10.0.0 ships an affected version
(4.1.89.Final through 4.2.6.Final).
+The affected range is therefore 9.2.0 – 10.0.0.</p></content><category
term="solr/vex"/></entry><entry><title>Netty: HTTP request smuggling via
setUri() CRLF-validation bypass</title><link href="/cve-2026-41417.html"
rel="alternate"/><published>2026-07-18T00:00:00+00:00</published><updated>2026-07-18T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-07-18:/cve-2026-41417.html</id><summary
type="html"><p>CVE-2026-41417 (CVSS 5.3) is a reque [...]
codec. <code>DefaultHttpRequest</code> and
<code>DefaultFullHttpRequest</code> reject CRLF and whitespace
characters in
their constructors, but the <code>setUri()</code> method that lets
a request's URI be rewritten after
construction has no equivalent validation, so an attacker who controls a
…</p></summary><content type="html"><p>CVE-2026-41417 (CVSS 5.3) is
a request-smuggling issue (CWE-93 / CWE-444) in Netty's HTTP/1.1
@@ -622,7 +631,11 @@ Solr is <strong>not
affected</strong>:</p>
on the classpath but not reachable in any real Solr deployment.</p>
<p>No released Solr version ships the fix. The fixed Netty
(4.2.15.Final) is already present on the
<code>branch_9x</code> (→ 9.11.0) and
<code>branch_10x</code> (→ 10.1.0) development branches, but hasn't
reached a
-released line yet.</p></content><category
term="solr/vex"/></entry><entry><title>Eclipse Jetty: differential URI parsing
can bypass front-end URI controls</title><link href="/cve-2025-11143.html"
rel="alternate"/><published>2026-06-18T00:00:00+00:00</published><updated>2026-06-18T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-06-18:/cve-2025-11143.html</id><summary
type="html"><p>CVE-2025-11143 (CVSS 6.5; 3.7 per the Eclipse Foundation)
[...]
+released line yet.</p></content><category
term="solr/vex"/></entry><entry><title>Jackson-core: async (non-blocking)
parser bypasses maxNumberLength (DoS)</title><link
href="/ghsa-72hv-8253-57qq.html"
rel="alternate"/><published>2026-07-18T00:00:00+00:00</published><updated>2026-07-18T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-07-18:/ghsa-72hv-8253-57qq.html</id><summary
type="html"><p>GHSA-72hv-8253-57qq is a DoS vulnerability in th [...]
+<p>GHSA-72hv-8253-57qq affects jackson-core releases before 2.18.6 and
the 2.19.0 through 2.21.0 line
+(fixed in 2.18.6 and 2.21.1). Solr has bundled jackson-core (alongside
<code>jackson-databind</code>, which it
+ships in lockstep with) since Solr 4.7.0, and every release through 10.0.0
ships an affected version
+(2.3.1 through 2.18.0, then 2.20.0). The affected range is therefore 4.7.0 –
10.0.0.</p></content><category
term="solr/vex"/></entry><entry><title>Eclipse Jetty: differential URI parsing
can bypass front-end URI controls</title><link href="/cve-2025-11143.html"
rel="alternate"/><published>2026-06-18T00:00:00+00:00</published><updated>2026-06-18T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-06-18:/cve-2025-11143.html</id><summary
type="html"> [...]
(CWE-20) in Eclipse Jetty's URI parser (<code>HttpURI</code>): it
interprets some invalid or unusual URIs
differently from other common HTTP parsers. When a component in front of Jetty
parses the same URI
differently, an attacker can craft …</p></summary><content
type="html"><p>CVE-2025-11143 (CVSS 6.5; 3.7 per the Eclipse Foundation)
is an improper-input-validation issue
@@ -2030,11 +2043,4 @@ ship any Struts jar — the dependency is excluded and
only appears as a transit
transitive dependency on <code>struts-core</code>,
<code>struts-taglib</code> and
<code>struts-tiles</code> 1.3.8. Solr does not
ship any Struts jar — the dependency is excluded and only appears as a
transitive POM listing
(see SOLR-2849) — so these Struts vulnerabilities are not present in, or
exploitable through, Solr.</p></content><category
term="solr/vex"/></entry><entry><title>vorbis-java-tika</title><link
href="/cve-2016-6809.html"
rel="alternate"/><published>2022-12-14T00:00:00+00:00</published><updated>2022-12-14T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2022-12-14:/cve-2016-6809.html</id><content
type="html"><p>See https://github.com/Gagravarr/Vo [...]
-<p>Tika as an in-process component was removed in Solr
9.11.</p></content><category
term="solr/vex"/></entry><entry><title>org.restlet</title><link
href="/cve-2017-14868.html"
rel="alternate"/><published>2022-12-14T00:00:00+00:00</published><updated>2022-12-14T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2022-12-14:/cve-2017-14868.html</id><content
type="html"><p>Solr should not be exposed outside a firewall where bad
actors can send [...]
-releases up to and including 2.0.6 (fixed in 2.0.6.1). Solr has bundled JDOM
(transitively, via
-Apache Tika / Solr Cell) since Solr 3.6.0 — <code>jdom</code> 1.0,
then <code>jdom</code> 2.0 …</p></summary><content
type="html"><p>CVE-2021-33813 is an XML external entity (XXE) issue in
JDOM's <code>SAXBuilder</code>, affecting all JDOM
-releases up to and including 2.0.6 (fixed in 2.0.6.1). Solr has bundled JDOM
(transitively, via
-Apache Tika / Solr Cell) since Solr 3.6.0 — <code>jdom</code> 1.0,
then <code>jdom</code> 2.0.2, then <code>jdom2</code>
2.0.6 —
-through the last 8.x release; Solr 9.0.0 upgraded to the fixed
<code>jdom2</code> 2.0.6.1. The affected range is
-therefore 3.6.0 – 8.8.1.</p>
-<p>JDOM is only used in Solr Cell, which should not be used in
production which makes the vulnerability unexploitable. It is a dependency of
Apache Tika, which has analyzed the issue and determined the vulnerability is
limited to two libraries not commonly used in search applications, see
TIKA-3488 for details. Since Tika should be used outside of Solr, use a version
of Tika which updates the affected libraries if concerned about exposure to
this issue.</p></content><category [...]
\ No newline at end of file
+<p>Tika as an in-process component was removed in Solr
9.11.</p></content><category
term="solr/vex"/></entry><entry><title>org.restlet</title><link
href="/cve-2017-14868.html"
rel="alternate"/><published>2022-12-14T00:00:00+00:00</published><updated>2022-12-14T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2022-12-14:/cve-2017-14868.html</id><content
type="html"><p>Solr should not be exposed outside a firewall where bad
actors can send [...]
\ No newline at end of file
diff --git a/output/feeds/solr/vex.atom.xml b/output/feeds/solr/vex.atom.xml
index 4394b881f..012843dab 100644
--- a/output/feeds/solr/vex.atom.xml
+++ b/output/feeds/solr/vex.atom.xml
@@ -1,5 +1,14 @@
<?xml version="1.0" encoding="utf-8"?>
-<feed xmlns="http://www.w3.org/2005/Atom";><title>Apache Solr -
solr/vex</title><link href="/" rel="alternate"/><link
href="/feeds/solr/vex.atom.xml"
rel="self"/><id>/</id><updated>2026-07-18T00:00:00+00:00</updated><entry><title>Netty:
HTTP request smuggling via setUri() CRLF-validation bypass</title><link
href="/cve-2026-41417.html"
rel="alternate"/><published>2026-07-18T00:00:00+00:00</published><updated>2026-07-18T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><i [...]
+<feed xmlns="http://www.w3.org/2005/Atom";><title>Apache Solr -
solr/vex</title><link href="/" rel="alternate"/><link
href="/feeds/solr/vex.atom.xml"
rel="self"/><id>/</id><updated>2026-07-18T00:00:00+00:00</updated><entry><title>Apache
Commons BeanUtils: class-loader access via a 'declaredClass' property
path</title><link href="/cve-2025-48734.html"
rel="alternate"/><published>2026-07-18T00:00:00+00:00</published><updated>2026-07-18T00:00:00+00:00</updated><author><name>Solr
Developers</ [...]
+<p>CVE-2025-48734 affects all Commons BeanUtils 1.x releases before
1.11.0. Solr has bundled
+commons-beanutils since Solr 3.6.0, and every release that includes it,
through Solr 10.0.0, ships an
+affected 1.x version (1.7.0, then 1.8.3, 1.9.3 and 1.9.4 — all below 1.11.0).
The affected range is
+therefore 3.6.0 – 10.0.0.</p></content><category
term="solr/vex"/></entry><entry><title>Netty: HTTP/1.1 request smuggling and
HTTP/2 CONTINUATION-flood DoS (server-side codec)</title><link
href="/cve-2026-33870.html"
rel="alternate"/><published>2026-07-18T00:00:00+00:00</published><updated>2026-07-18T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-07-18:/cve-2026-33870.html</id><summary
type="html"><p>CVE-2026-33870 is an HTTP/1.1 reques [...]
+<p>Both CVEs affect Netty releases before 4.1.132 and 4.2.0 through
4.2.9. Solr has bundled the modular
+<code>netty-codec-http</code> /
<code>netty-codec-http2</code> artifacts (transitively, via
ZooKeeper and the optional
+OpenTelemetry OTLP exporter) since Solr 9.2.0 — earlier releases used the
<code>netty-all</code> uber-jar — and
+every release from 9.2.0 through 10.0.0 ships an affected version
(4.1.89.Final through 4.2.6.Final).
+The affected range is therefore 9.2.0 – 10.0.0.</p></content><category
term="solr/vex"/></entry><entry><title>Netty: HTTP request smuggling via
setUri() CRLF-validation bypass</title><link href="/cve-2026-41417.html"
rel="alternate"/><published>2026-07-18T00:00:00+00:00</published><updated>2026-07-18T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-07-18:/cve-2026-41417.html</id><summary
type="html"><p>CVE-2026-41417 (CVSS 5.3) is a reque [...]
codec. <code>DefaultHttpRequest</code> and
<code>DefaultFullHttpRequest</code> reject CRLF and whitespace
characters in
their constructors, but the <code>setUri()</code> method that lets
a request's URI be rewritten after
construction has no equivalent validation, so an attacker who controls a
…</p></summary><content type="html"><p>CVE-2026-41417 (CVSS 5.3) is
a request-smuggling issue (CWE-93 / CWE-444) in Netty's HTTP/1.1
@@ -622,7 +631,11 @@ Solr is <strong>not
affected</strong>:</p>
on the classpath but not reachable in any real Solr deployment.</p>
<p>No released Solr version ships the fix. The fixed Netty
(4.2.15.Final) is already present on the
<code>branch_9x</code> (→ 9.11.0) and
<code>branch_10x</code> (→ 10.1.0) development branches, but hasn't
reached a
-released line yet.</p></content><category
term="solr/vex"/></entry><entry><title>Eclipse Jetty: differential URI parsing
can bypass front-end URI controls</title><link href="/cve-2025-11143.html"
rel="alternate"/><published>2026-06-18T00:00:00+00:00</published><updated>2026-06-18T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-06-18:/cve-2025-11143.html</id><summary
type="html"><p>CVE-2025-11143 (CVSS 6.5; 3.7 per the Eclipse Foundation)
[...]
+released line yet.</p></content><category
term="solr/vex"/></entry><entry><title>Jackson-core: async (non-blocking)
parser bypasses maxNumberLength (DoS)</title><link
href="/ghsa-72hv-8253-57qq.html"
rel="alternate"/><published>2026-07-18T00:00:00+00:00</published><updated>2026-07-18T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-07-18:/ghsa-72hv-8253-57qq.html</id><summary
type="html"><p>GHSA-72hv-8253-57qq is a DoS vulnerability in th [...]
+<p>GHSA-72hv-8253-57qq affects jackson-core releases before 2.18.6 and
the 2.19.0 through 2.21.0 line
+(fixed in 2.18.6 and 2.21.1). Solr has bundled jackson-core (alongside
<code>jackson-databind</code>, which it
+ships in lockstep with) since Solr 4.7.0, and every release through 10.0.0
ships an affected version
+(2.3.1 through 2.18.0, then 2.20.0). The affected range is therefore 4.7.0 –
10.0.0.</p></content><category
term="solr/vex"/></entry><entry><title>Eclipse Jetty: differential URI parsing
can bypass front-end URI controls</title><link href="/cve-2025-11143.html"
rel="alternate"/><published>2026-06-18T00:00:00+00:00</published><updated>2026-06-18T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-06-18:/cve-2025-11143.html</id><summary
type="html"> [...]
(CWE-20) in Eclipse Jetty's URI parser (<code>HttpURI</code>): it
interprets some invalid or unusual URIs
differently from other common HTTP parsers. When a component in front of Jetty
parses the same URI
differently, an attacker can craft …</p></summary><content
type="html"><p>CVE-2025-11143 (CVSS 6.5; 3.7 per the Eclipse Foundation)
is an improper-input-validation issue
diff --git a/output/security-dependency-cves.html
b/output/security-dependency-cves.html
index d2c380ccb..fd7863e78 100644
--- a/output/security-dependency-cves.html
+++ b/output/security-dependency-cves.html
@@ -153,16 +153,27 @@ VEX is an open standard that lets vendors state
explicitly whether a CVE applies
and why. A number of formats are under active development, including
<a href="https://cyclonedx.org/capabilities/vex/";>CycloneDX</a> and
<a
href="https://github.com/oasis-tcs/csaf/blob/master/csaf_2.0/prose/csaf-v2-editor-draft.md#45-profile-5-vex";>CSAF</a>.
-We currently publish in CycloneDX 1.6 JSON format.</p>
+We publish this assessment in both <strong>CycloneDX 1.6</strong> and
<strong>OpenVEX</strong> JSON formats (download links below).</p>
<p>If your scanner supports VEX, download the file below and point your
scanner at it to automatically
suppress known non-applicable findings. If your scanner does not yet support
VEX, you can use the
table on this page to manually triage flagged CVEs.</p>
+<p>For example, <a href="https://docs.docker.com/scout/";>Docker Scout</a> can
apply the OpenVEX file when scanning
+an official Solr image:</p>
+<div class="codehilite"><pre><span></span><code><span class="c1"># Download
the OpenVEX file, then have Docker Scout apply it to a scan.</span>
+curl<span class="w"> </span>-sO<span class="w">
</span>https://solr.apache.org/solr.openvex.json
+docker<span class="w"> </span>scout<span class="w"> </span>cves<span
class="w"> </span>solr:9.9.0<span class="w"> </span>--vex-location<span
class="w"> </span>solr.openvex.json<span class="w"> </span>--vex-author<span
class="w"> </span><span class="s1">'.*'</span>
+</code></pre></div>
+
+<p>CVEs marked <code>not_affected</code> are then dropped from the results,
while those marked <code>affected</code> remain.
+(Solr's VEX is authored by the Apache Solr project, so <code>--vex-author
'.*'</code> is required — by default
+Docker Scout only trusts VEX statements authored by
<code>*@docker.com</code>.)</p>
<p>We encourage feedback on VEX and tool support — join the discussion at
<a
href="mailto:[email protected]";>[email protected]</a>
or contact <a href="mailto:[email protected]";>[email protected]</a>.</p>
<div class="vex-download">
- <a href="/solr.vex.json" class="button large" download>⬇ Download Solr VEX
File (JSON)</a>
+ <a href="/solr.vex.json" class="button large" download>⬇ Download Solr VEX
File (CycloneDX JSON)</a>
+ <a href="/solr.openvex.json" class="button large" download>⬇ Download Solr
VEX File (OpenVEX JSON)</a>
</div>
<h2 id="cve-table">CVE Status for Dependencies <a class="headerlink"
href="#cve-table" title="Permanent link">¶</a></h2>
@@ -180,6 +191,15 @@ or contact <a
href="mailto:[email protected]";>[email protected]</a>.</p>
</tr>
<tr>
<td>
+<a
href="https://github.com/advisories/GHSA-72hv-8253-57qq";>GHSA-72hv-8253-57qq</a>
</td>
+ <td>4.7.0-10.0.0</td>
+ <td>
+ jackson-core-2.20.0.jar </td>
+ <td><span class="cdx-not-affected">not affected</span></td>
+ <td><a href="/vex.html#ghsa-72hv-8253-57qq">Jackson-core: async
(non-blocking) parser bypasses maxNumberLength (DoS)</a></td>
+ </tr>
+ <tr>
+ <td>
<a href="https://nvd.nist.gov/vuln/detail/CVE-2026-50560";>CVE-2026-50560</a>
</td>
<td>9.2.0-9.10.x,10.0.x</td>
<td>
@@ -333,6 +353,24 @@ or contact <a
href="mailto:[email protected]";>[email protected]</a>.</p>
</tr>
<tr>
<td>
+<a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33870";>CVE-2026-33870</a>,
<a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33871";>CVE-2026-33871</a>
</td>
+ <td>9.2.0-10.0.0</td>
+ <td>
+ netty-codec-http-4.2.6.Final.jar,
netty-codec-http2-4.2.6.Final.jar </td>
+ <td><span class="cdx-not-affected">not affected</span></td>
+ <td><a href="/vex.html#cve-2026-33870">Netty: HTTP/1.1 request smuggling
and HTTP/2 CONTINUATION-flood DoS (server-side codec)</a></td>
+ </tr>
+ <tr>
+ <td>
+<a href="https://nvd.nist.gov/vuln/detail/CVE-2025-48734";>CVE-2025-48734</a>
</td>
+ <td>3.6.0-10.0.0</td>
+ <td>
+ commons-beanutils-1.9.4.jar </td>
+ <td><span class="cdx-not-affected">not affected</span></td>
+ <td><a href="/vex.html#cve-2025-48734">Apache Commons BeanUtils:
class-loader access via a 'declaredClass' property path</a></td>
+ </tr>
+ <tr>
+ <td>
<a href="https://nvd.nist.gov/vuln/detail/CVE-2026-5795";>CVE-2026-5795</a>
</td>
<td>7.3.0-10.0.0</td>
<td>
diff --git a/output/solr.openvex.json b/output/solr.openvex.json
new file mode 100644
index 000000000..a055f5a33
--- /dev/null
+++ b/output/solr.openvex.json
@@ -0,0 +1,2181 @@
+{
+ "@context": "https://openvex.dev/ns/v0.2.0";,
+ "@id": "https://solr.apache.org/solr.openvex.json";,
+ "author": "Apache Solr Project ([email protected])",
+ "timestamp": "2026-07-18T00:00:00Z",
+ "version": 1,
+ "statements": [
+ {
+ "vulnerability": {
+ "name": "CVE-2012-0881"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/xerces/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/xerces/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/xerces/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2022-12-14T00:00:00Z",
+ "impact_statement": "Only used in Lucene Benchmarks and Solr tests.",
+ "status_notes": "Affected Apache Solr versions: 2.9-9.10."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2012-2098",
+ "aliases": [
+ "CVE-2018-1324",
+ "CVE-2018-11771"
+ ]
+ },
+ "products": [
+ {
+ "@id": "commons-compress (only as part of Ant 1.8.2)"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2022-12-14T00:00:00Z",
+ "impact_statement": "Only used in test framework and at build time.",
+ "status_notes": "Affected Apache Solr versions: 4.6.0-7.x."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2014-0114"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/commons-beanutils/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2022-12-14T00:00:00Z",
+ "impact_statement": "This is only used at compile time and it cannot be
used to attack Solr. Since it is generally unnecessary, the dependency has been
removed as of 7.5.0. See SOLR-12617.",
+ "status_notes": "Affected Apache Solr versions: 4.9.0-7.5.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2014-7940",
+ "aliases": [
+ "CVE-2016-6293",
+ "CVE-2016-7415",
+ "CVE-2017-14952",
+ "CVE-2017-17484",
+ "CVE-2017-7867",
+ "CVE-2017-7868"
+ ]
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.apache.lucene/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2022-12-14T00:00:00Z",
+ "impact_statement": "All of these issues apply to the C++ release of ICU
and not ICU4J, which is what Lucene uses.",
+ "status_notes": "Affected Apache Solr versions: 7.3.1."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2015-5237"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/com.google.protobuf/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2022-12-14T00:00:00Z",
+ "impact_statement": "Dependency for Hadoop and Calcite. ??",
+ "status_notes": "Affected Apache Solr versions: 6.5.0-7.x."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2015-0899",
+ "aliases": [
+ "CVE-2016-1181",
+ "CVE-2016-1182"
+ ]
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.apache.velocity/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2022-12-14T00:00:00Z",
+ "impact_statement": "Scanners flag `velocity-tools-2.0.jar` with Apache
Struts 1 CVEs because its POM declares a\ntransitive dependency on
`struts-core`, `struts-taglib` and `struts-tiles` 1.3.8. Solr does not\nship
any Struts jar \u2014 the dependency is excluded and only appears as a
transitive POM listing\n(see SOLR-2849) \u2014 so these Struts vulnerabilities
are not present in, or exploitable through, Solr.",
+ "status_notes": "Affected Apache Solr versions: 6.6.2-8.x."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2016-6809",
+ "aliases": [
+ "CVE-2018-1335",
+ "CVE-2018-1338",
+ "CVE-2018-1339"
+ ]
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.gagravarr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.gagravarr/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2022-12-14T00:00:00Z",
+ "impact_statement": "See
https://github.com/Gagravarr/VorbisJava/issues/30; reported CVEs are not
related to OggVorbis at all.\n\nTika as an in-process component was removed in
Solr 9.11.",
+ "status_notes": "Affected Apache Solr versions: 5.5.5, 6.2.0-9.10."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2017-14868",
+ "aliases": [
+ "CVE-2017-14949"
+ ]
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.restlet.jee/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.restlet.jee/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.restlet.jee/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2022-12-14T00:00:00Z",
+ "impact_statement": "Solr should not be exposed outside a firewall where
bad actors can send HTTP requests. These two CVEs specifically involve classes
(SimpleXMLProvider and XmlRepresentation, respectively) that Solr does not use
in any code path.",
+ "status_notes": "Affected Apache Solr versions: 5.2.0-8.x."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2017-14952"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/com.ibm.icu/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/com.ibm.icu/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/com.ibm.icu/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/com.ibm.icu/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2022-12-14T00:00:00Z",
+ "impact_statement": "Issue applies only to the C++ release of ICU and
not ICU4J, which is what Lucene uses. ICU4J is at v63.2 as of Lucene/Solr
7.6.0",
+ "status_notes": "Affected Apache Solr versions: 6.0.0-7.5.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2017-15095",
+ "aliases": [
+ "CVE-2017-17485",
+ "CVE-2017-7525",
+ "CVE-2018-5968",
+ "CVE-2018-7489",
+ "CVE-2019-12086",
+ "CVE-2019-12384",
+ "CVE-2018-12814",
+ "CVE-2019-14379",
+ "CVE-2019-14439",
+ "CVE-2020-35490",
+ "CVE-2020-35491",
+ "CVE-2021-20190",
+ "CVE-2019-14540",
+ "CVE-2019-16335"
+ ]
+ },
+ "products": [
+ {
+ "@id": "jackson-databind-*.jar"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2022-12-14T00:00:00Z",
+ "impact_statement": "These CVEs, and most of the known jackson-databind
CVEs since 2017, are all related to problematic 'gadgets' that could be
exploited during deserialization of untrusted data. The Jackson developers
described 4 conditions that must be met in order for a problematic gadget to be
exploited. See
https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062.
Solr's use of jackson-databind does not meet 1 of the 4 conditions d [...]
+ "status_notes": "Affected Apache Solr versions: 4.7.0-8.x."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2017-15718"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.apache.hadoop/[email protected]"
+ },
+ {
+ "@id": "hadoop-hdfs-2.7.4.jar (all Hadoop)"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2022-12-14T00:00:00Z",
+ "impact_statement": "Does not impact Solr because Solr uses Hadoop as a
client library.",
+ "status_notes": "Affected Apache Solr versions: 6.6.1-7.6.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2018-1000056"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/junit/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2022-12-14T00:00:00Z",
+ "impact_statement": "JUnit only used in tests; CVE only refers to a
Jenkins plugin not used by Solr.",
+ "status_notes": "Affected Apache Solr versions: 4.6.0-7.6.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2018-1000632"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/dom4j/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2022-12-14T00:00:00Z",
+ "impact_statement": "Only used in Solr tests.",
+ "status_notes": "Affected Apache Solr versions: 4.6.0-8.x."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2018-10237"
+ },
+ "products": [
+ {
+ "@id": "guava-*.jar"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2022-12-14T00:00:00Z",
+ "impact_statement": "Only used in tests.",
+ "status_notes": "Affected Apache Solr versions: 4.6.0-8.x."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2018-10237"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.carrot2.shaded/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2022-12-14T00:00:00Z",
+ "impact_statement": "Only used with the Carrot2 clustering engine.",
+ "status_notes": "Affected Apache Solr versions: 5.4.0-8.x."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2018-1335"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.apache.tika/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.tika/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2022-12-14T00:00:00Z",
+ "impact_statement": "Solr does not run tika-server, so this is not a
problem.",
+ "status_notes": "Affected Apache Solr versions: 7.3.1-7.5.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2018-1471"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.simpleframework/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2022-12-14T00:00:00Z",
+ "impact_statement": "Dependency of Carrot2 and used during compilation,
not at runtime (see SOLR-769. This .jar was replaced in Solr 8.3 and backported
to 7.7.3 (see SOLR-13779).",
+ "status_notes": "Affected Apache Solr versions: 5.4.0-7.7.2, 8.0-8.3."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2018-8088"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.slf4j/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.slf4j/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.slf4j/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.slf4j/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.slf4j/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.slf4j/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.slf4j/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.slf4j/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.slf4j/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.slf4j/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.slf4j/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.slf4j/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.slf4j/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.slf4j/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.slf4j/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.slf4j/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.slf4j/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2022-12-14T00:00:00Z",
+ "impact_statement": "The reported CVE impacts org.slf4j.ext.EventData,
which is not used in Solr.",
+ "status_notes": "Affected Apache Solr versions: 4.x-9.1."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2019-10086"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/commons-beanutils/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2022-12-14T00:00:00Z",
+ "impact_statement": "While commons-beanutils was removed in 7.5, it was
added back in 8.0 in error and removed again in 8.3. The vulnerable class was
not used in any Solr code path. This jar remains a dependency of both Velocity
and hadoop-common, but Solr does not use it in our implementations.",
+ "status_notes": "Affected Apache Solr versions: 8.0.0-8.3.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2019-10241",
+ "aliases": [
+ "CVE-2019-10247"
+ ]
+ },
+ "products": [
+ {
+ "@id": "jetty-9.4.14"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2022-12-14T00:00:00Z",
+ "impact_statement": "Solr upgraded to Jetty 9.4.19 for the 8.2 release.
Additionally, the path to exploit these vulnerabilities was fixed in 8.1 and
7.7.2. Earlier versions can manually patch their configurations as described in
SOLR-13409.",
+ "status_notes": "Affected Apache Solr versions: 7.7.0-8.2."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2019-16869"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2022-12-14T00:00:00Z",
+ "impact_statement": "This is not included in Solr but is a dependency of
ZooKeeper 3.5.5. The version was upgraded in ZooKeeper 3.5.6, included with
Solr 8.3. The specific classes mentioned in the CVE are not used in Solr (nor
in ZooKeeper as far as the Solr community can determine).",
+ "status_notes": "Affected Apache Solr versions: 8.2-8.3."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2020-13955"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.apache.calcite.avatica/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.calcite/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2022-12-14T00:00:00Z",
+ "impact_statement": "Solr's SQL adapter does not use the vulnerable
class \"HttpUtils\". Calcite only used it to talk to Druid or Splunk.",
+ "status_notes": "Affected Apache Solr versions: 8.1.0-8.x."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2020-27218"
+ },
+ "products": [
+ {
+ "@id": "jetty-9.4.0 to 9.4.34"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2022-12-14T00:00:00Z",
+ "impact_statement": "Only exploitable through use of Jetty's
GzipHandler, which is only implemented in Embedded Solr Server.",
+ "status_notes": "Affected Apache Solr versions: 7.3.0-8.8.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2020-27223"
+ },
+ "products": [
+ {
+ "@id": "jetty-9.4.6 to 9.4.36"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2022-12-14T00:00:00Z",
+ "impact_statement": "Only exploitable if Solr's webapp directory is
deployed as a symlink, which is not Solr's default.",
+ "status_notes": "Affected Apache Solr versions: 7.3.0-8.x."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2021-33813"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.jdom/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.jdom/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.jdom/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2022-12-14T00:00:00Z",
+ "impact_statement": "CVE-2021-33813 is an XML external entity (XXE)
issue in JDOM's `SAXBuilder`, affecting all JDOM\nreleases up to and including
2.0.6 (fixed in 2.0.6.1). Solr has bundled JDOM (transitively, via\nApache Tika
/ Solr Cell) since Solr 3.6.0 \u2014 `jdom` 1.0, then `jdom` 2.0.2, then
`jdom2` 2.0.6 \u2014\nthrough the last 8.x release; Solr 9.0.0 upgraded to the
fixed `jdom2` 2.0.6.1. The affected range is\ntherefore 3.6.0 \u2013
8.8.1.\n\nJDOM is only used in Solr Ce [...]
+ "status_notes": "Affected Apache Solr versions: 3.6.0-8.8.1."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2021-44832"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.apache.logging.log4j/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.logging.log4j/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.logging.log4j/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2022-12-14T00:00:00Z",
+ "impact_statement": "Solr's default log configuration doesn't use
JDBCAppender and we don't imagine a user would want to use it or other obscure
appenders.",
+ "status_notes": "Affected Apache Solr versions: 7.4-8.11.1."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2021-45105",
+ "aliases": [
+ "CVE-2021-45046"
+ ]
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.apache.logging.log4j/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.logging.log4j/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.logging.log4j/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2022-12-14T00:00:00Z",
+ "impact_statement": "The MDC data used by Solr are for the collection,
shard, replica, core and node names, and a potential trace id, which are all
sanitized. Furthermore, Solr's default log configuration doesn't use
double-dollar-sign and we don't imagine a user would want to do that.",
+ "status_notes": "Affected Apache Solr versions: 7.4-8.11.1."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2022-25168"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.apache.hadoop/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.hadoop/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.hadoop/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.hadoop/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.hadoop/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.hadoop/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.hadoop/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.hadoop/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2022-12-14T00:00:00Z",
+ "impact_statement": "CVE-2022-25168 is a command-injection flaw in
Apache Hadoop's `FileUtil.unTar(...)`, which fails to\nescape the input
filename before passing it to a shell. It affects `hadoop-common`
2.0.0\u20132.10.1,\n3.0.0-alpha\u20133.2.3 and 3.3.0\u20133.3.2 (fixed in
2.10.2, 3.2.4 and 3.3.3). Solr has bundled an affected\n`hadoop-common`
(transitively, for HDFS support) since Solr 4.4.0, through Solr 9.0.0 (which
ships\n3.3.2); Solr 9.1.0 upgraded to the fixed 3.3.4. The [...]
+ "status_notes": "Affected Apache Solr versions: 4.4.0-9.0.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2022-33980"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.apache.commons/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2022-12-14T00:00:00Z",
+ "impact_statement": "CVE-2022-33980 is a code-execution issue in Apache
Commons Configuration: versions 2.4 through 2.7\nperformed variable
interpolation with `script`, `dns` and `url` lookups enabled by default (fixed
in\n2.8.0). Only Solr 9.0.0 shipped an affected version
(`commons-configuration2` 2.7); Solr 8.x shipped\n2.1.1 (before the flaw was
introduced) and Solr 9.1.0 upgraded to the fixed 2.8.0. The affected\nversion
is therefore 9.0.0 only.\n\nSolr uses commons-configurat [...]
+ "status_notes": "Affected Apache Solr versions: 9.0.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2022-39135"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.apache.calcite/[email protected]"
+ }
+ ],
+ "status": "affected",
+ "timestamp": "2022-12-14T00:00:00Z",
+ "action_statement": "Apache Calcite has a vulnerability, CVE-2022-39135,
that is exploitable in Apache Solr in SolrCloud mode. If an untrusted user can
supply SQL queries to Solr's '/sql' handler (even indirectly via proxies /
other apps), then the user could perform an XML External Entity (XXE) attack.
This might have been exposed by some deployers of Solr in order for internal
analysts to use JDBC based tooling, but would have unlikely been granted to
wider audiences.",
+ "status_notes": "Affected Apache Solr versions: 6.5-8.11.2, 9.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2022-42889"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.apache.commons/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.commons/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2022-12-14T00:00:00Z",
+ "impact_statement": "CVE-2022-42889 (\"Text4Shell\") is a code-execution
issue in Apache Commons Text: from version 1.5\nthrough 1.9, the default
`StringSubstitutor` interpolators included `script`, `dns` and `url`\nlookups
that could execute arbitrary code (fixed in 1.10.0). Solr bundled an affected
`commons-text`\nin 8.1.0 (1.6) through 9.0.0 (1.8); Solr 8.0.0 shipped 1.4
(before the flaw was introduced) and Solr\n9.1.0 upgraded to the fixed 1.10.0.
The affected range is therefor [...]
+ "status_notes": "Affected Apache Solr versions: 8.1.0-9.0.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2023-51074",
+ "aliases": [
+ "GHSA-pfh2-hfmq-phg5"
+ ]
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/com.jayway.jsonpath/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/com.jayway.jsonpath/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/com.jayway.jsonpath/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2024-01-12T00:00:00Z",
+ "impact_statement": "The only places we use json-path is for querying
(via Calcite) and for transforming/indexing custom JSON. Since the advisory
describes a problem that is limited to the current thread, and users that are
allowed to query/transform/index are already trusted to cause load to some
extent, this advisory does not appear to have impact on the way json-path is
used in Solr.\n\nCVE-2023-51074 affects json-path 2.2.0 through 2.8.0 (fixed in
2.9.0). Solr first bundled jso [...]
+ "status_notes": "Affected Apache Solr versions: 8.1.0-9.5.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2025-24814"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.solr/[email protected]"
+ }
+ ],
+ "status": "affected",
+ "timestamp": "2025-01-26T00:00:00Z",
+ "action_statement": "Core creation allows users to replace \"trusted\"
configset files with arbitrary configuration\n\nSolr instances are vulnerable
if they:\n\n1. use the `FileSystemConfigSetService` component (the default in
\"standalone\" or \"user-managed\" mode), and\n2. run without authentication
and authorization enabled\n\nIn this configuration, attackers can exploit a
privilege escalation issue by replacing individual \"trusted\" configset files
with potentially untrusted [...]
+ "status_notes": "Affected Apache Solr versions: 4.8.0-9.7.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2024-6763"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2025-02-26T00:00:00Z",
+ "impact_statement": "CVE-2024-6763 is an improper-input-validation issue
in Eclipse Jetty's `HttpURI` parser, affecting\nJetty from 7.0.0 up to (but not
including) 12.0.12 (fixed in 12.0.12, with a 9.4.57 backport on
the\nstill-supported 9.4.x branch). Solr bundles Jetty as its HTTP server, so
scanners flag this CVE on\nevery Solr release whose Jetty predates 12.0.12
\u2014 Jetty 8.1.x/9.4.x/10.0.x from Solr 4.0.0 through\nSolr 9.10.1. Solr
10.0.0 ships Jetty 12.0.27 (\u2265 12.0.1 [...]
+ "status_notes": "Affected Apache Solr versions: 4.0.0-9.10.1."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2024-51504"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.apache.zookeeper/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.zookeeper/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.zookeeper/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2025-07-25T00:00:00Z",
+ "impact_statement": "CVE-2024-51504 is **not** considered exploitable in
typical **production** deployments of Apache Solr.\nSuccessful exploitation
requires a very specific and non-standard configuration.\nThe following
conditions **must all be met**:\n\n* Solr must be deployed in [SolrCloud
mode](https://solr.apache.org/guide/solr/latest/deployment-guide/cluster-types.html#solrcloud-mode),
which relies on ZooKeeper for coordination.\n* The **embedded ZooKeeper
server** must be in [...]
+ "status_notes": "Affected Apache Solr versions: 9.4.0-9.8.1."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2024-7254"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/com.google.protobuf/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/com.google.protobuf/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/com.google.protobuf/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/com.google.protobuf/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/com.google.protobuf/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/com.google.protobuf/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/com.google.protobuf/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/com.google.protobuf/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/com.google.protobuf/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/com.google.protobuf/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/com.google.protobuf/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/com.google.protobuf/[email protected]"
+ }
+ ],
+ "status": "under_investigation",
+ "timestamp": "2025-08-02T00:00:00Z",
+ "status_notes": "Affected Apache Solr versions: 4.4.0-9.9.0. When
parsing unknown fields in the Protobuf Java Lite and Full library, a
maliciously crafted message can cause a StackOverflow error and lead to a
program crash.\n\nCVE-2024-7254 affects all `protobuf-java` releases before
3.25.5 (per the upstream advisory the\nflaw was introduced at version 0, and is
fixed in 3.25.5 / 4.27.5 / 4.28.2). Apache Solr has bundled\n`protobuf-java`
(transitively, via Hadoop and ZooKeeper) sin [...]
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2025-48924"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.apache.commons/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.commons/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.commons/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.commons/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2025-08-04T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "CVE-2025-48924 is an uncontrolled-recursion issue
in Apache Commons Lang's\n`ClassUtils.getClass(...)`: a very long,
deeply-nested class name can exhaust the stack and\nthrow `StackOverflowError`.
It affects `commons-lang3` from 3.0 up to (but not including) 3.18.0,\nso
dependency scanners flag the `commons-lang3` JAR bundled in Solr 9.x (which
ships versions\n3.12.0 through 3.15.0 across the 9.0\u20139.9 line).\n\nSolr is
**not affected**. The vulnerable `Clas [...]
+ "status_notes": "Affected Apache Solr versions: 9.0.0-9.9.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2026-34477"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.apache.logging.log4j/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-04-10T00:00:00Z",
+ "impact_statement": "CVE-2026-34477 is **not** considered exploitable in
typical deployments of Apache Solr.\nSuccessful exploitation requires a
specific, non-default logging configuration together with a privileged network
position.\nThe following conditions **must all be met**:\n\n* The Log4j
configuration is modified to add an `SMTP`, `Socket` or `Syslog` appender that
ships logs over TLS through a nested `<Ssl>` element.\n* That appender relies
on the `verifyHostName` attribute [...]
+ "status_notes": "Affected Apache Solr versions: 9.10.1, 10.0.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2026-34478"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.apache.logging.log4j/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-04-10T00:00:00Z",
+ "impact_statement": "CVE-2026-34478 is **not** considered exploitable in
typical deployments of Apache Solr.\nSuccessful exploitation requires a
specific, non-default logging configuration.\nThe following conditions **must
all be met**:\n\n* The Log4j configuration is modified to send logs to a
stream-based (TCP or TLS) syslog service using `Rfc5424Layout` directly.\n* An
attacker is able to inject CRLF sequences into the logged data.\n\nBecause the
`newLineEscape` and `useTlsMessa [...]
+ "status_notes": "Affected Apache Solr versions: 9.10.1, 10.0.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2026-34479"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.apache.logging.log4j/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-04-10T00:00:00Z",
+ "impact_statement": "CVE-2026-34479 is **not** considered exploitable in
typical deployments of Apache Solr.\nSuccessful exploitation requires a
specific, non-default logging configuration.\nThe following conditions **must
all be met**:\n\n* The Log4j 1-to-Log4j 2 bridge emits logs through
`Log4j1XmlLayout`,\n either configured directly in a Log4j 2 configuration\n
or selected as `org.apache.log4j.xml.XMLLayout` through the Log4j 1
compatibility layer.\n* The logged data contains [...]
+ "status_notes": "Affected Apache Solr versions: 9.10.1, 10.0.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2026-34480"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.apache.logging.log4j/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-04-10T00:00:00Z",
+ "impact_statement": "CVE-2026-34480 is **not** considered exploitable in
typical deployments of Apache Solr.\nSuccessful exploitation requires a
specific, non-default logging configuration.\nThe following conditions **must
all be met**:\n\n* The Log4j configuration is modified to write events through
`XmlLayout`.\n* A log message or MDC value contains characters forbidden by the
XML 1.0 specification.\n\nWhen triggered, the layout produces malformed XML,
which downstream log proces [...]
+ "status_notes": "Affected Apache Solr versions: 9.10.1, 10.0.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2026-34481"
+ },
+ "products": [
+ {
+ "@id":
"pkg:maven/org.apache.logging.log4j/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-04-10T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "CVE-2026-34481 is **not** considered exploitable in
any deployment of the Apache Solr binary distribution.\nSuccessful exploitation
requires the application to log a `MapMessage` (or one of its
subclasses)\ncarrying a non-finite floating-point value (`NaN`, `Infinity` or
`-Infinity`) through `JsonTemplateLayout`,\nwhich the layout then serializes as
invalid JSON, in breach of RFC 8259.\n\nProducing a `MapMessage` requires
application code, and users of the bina [...]
+ "status_notes": "Affected Apache Solr versions: 9.10.1, 10.0.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2026-40682"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.apache.opennlp/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.opennlp/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.opennlp/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.opennlp/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.opennlp/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.opennlp/[email protected]"
+ }
+ ],
+ "status": "affected",
+ "timestamp": "2026-05-04T00:00:00Z",
+ "action_statement": "CVE-2026-40682 (CVSS 9.1) is an XML External Entity
(XXE) vulnerability in Apache OpenNLP's\ndictionary parsing. The
`DictionaryEntryPersistor` class and the public
`Dictionary(InputStream)`\nconstructor create a SAX parser without enabling
`FEATURE_SECURE_PROCESSING` or disabling DTD\nprocessing, so external entity
resolution and DOCTYPE declarations remain fully enabled. An attacker\nwho can
supply a crafted dictionary file \u2014 either directly or embedded [...]
+ "status_notes": "Affected Apache Solr versions: 7.3.0-10.0.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2026-42027"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.apache.opennlp/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.opennlp/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.opennlp/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.opennlp/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.opennlp/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.opennlp/[email protected]"
+ }
+ ],
+ "status": "affected",
+ "timestamp": "2026-05-04T00:00:00Z",
+ "action_statement": "CVE-2026-42027 (CVSS 9.8) is an arbitrary class
instantiation issue in Apache OpenNLP's\n`ExtensionLoader`. The
`instantiateExtension(Class, String)` method loads a class named in a\nmodel
archive's `manifest.properties` via `Class.forName()` and only performs
its\n`isAssignableFrom` type check *after* the class has been loaded. Because
`Class.forName()`\nruns the target class's static initializer at load time, an
attacker who can supply a crafted\nmodel archiv [...]
+ "status_notes": "Affected Apache Solr versions: 7.3.0-10.0.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2026-42440"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.apache.opennlp/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.opennlp/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.opennlp/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.opennlp/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.opennlp/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.opennlp/[email protected]"
+ }
+ ],
+ "status": "affected",
+ "timestamp": "2026-05-04T00:00:00Z",
+ "action_statement": "CVE-2026-42440 (CVSS 7.5) is an out-of-memory
denial-of-service issue in Apache OpenNLP's binary\nmodel reader. The
`AbstractModelReader` methods `getOutcomes()`, `getOutcomePatterns()`
and\n`getPredicates()` read a 32-bit signed integer count field from a binary
model stream and pass it\ndirectly to an array allocation without validating
it. An attacker who can supply a crafted `.bin`\nmodel file with a count set to
`Integer.MAX_VALUE` triggers an immediate `O [...]
+ "status_notes": "Affected Apache Solr versions: 7.3.0-10.0.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2025-11143"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-06-18T00:00:00Z",
+ "impact_statement": "CVE-2025-11143 (CVSS 6.5; 3.7 per the Eclipse
Foundation) is an improper-input-validation issue\n(CWE-20) in Eclipse Jetty's
URI parser (`HttpURI`): it interprets some invalid or unusual URIs\ndifferently
from other common HTTP parsers. When a component in front of Jetty parses the
same URI\ndifferently, an attacker can craft a malformed URI to bypass
URI-based security controls (such as\npath allow/deny lists) or to reveal
implementation details. It affects Je [...]
+ "status_notes": "Affected Apache Solr versions: 7.3.0-10.0.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2026-2332"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ }
+ ],
+ "status": "affected",
+ "timestamp": "2026-06-18T00:00:00Z",
+ "action_statement": "CVE-2026-2332 (CVSS 9.1) is an HTTP
request-smuggling issue (CWE-444) in Eclipse Jetty's HTTP/1.1\nparser: the
chunk-extension parser stops at a `\\r\\n` inside a quoted string instead of
treating it\nas an error, so a crafted chunk extension can desynchronize
request boundaries between Jetty and a\nfront-end HTTP intermediary. It affects
Jetty 9.4.0\u20139.4.59, 10.0.0\u201310.0.27,
11.0.0\u201311.0.27,\n12.0.0\u201312.0.32 and 12.1.0\u201312.1.6; it is fixed
[...]
+ "status_notes": "Affected Apache Solr versions: 7.3.0-10.0.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2026-5795"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.eclipse.jetty/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-06-18T00:00:00Z",
+ "justification": "vulnerable_code_not_present",
+ "impact_statement": "CVE-2026-5795 (CVSS 7.4) is a broken-access-control
/ privilege-escalation issue in Eclipse Jetty's\n`JASPIAuthenticator` (the
JSR-196 / Jakarta Authentication \"JASPI\" integration). During
an\nauthentication check it sets thread-local state and, on an early return,
fails to clear it, so a\nsubsequent request served by the same pooled thread
can inherit that authentication state. It\naffects Jetty 9.4.0\u20139.4.60,
10.0.0\u201310.0.28, 11.0.0\u201311.0.28, 12 [...]
+ "status_notes": "Affected Apache Solr versions: 7.3.0-10.0.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2025-48734"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/commons-beanutils/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/commons-beanutils/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/commons-beanutils/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/commons-beanutils/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-07-18T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "CVE-2025-48734 allows an attacker to access the JVM
ClassLoader (and potentially execute arbitrary code) by passing a property path
containing 'declaredClass' to PropertyUtilsBean.getProperty() or
getNestedProperty(). Exploitation requires an application to pass externally
supplied property path strings to these BeanUtils methods. A search of the Solr
codebase confirms that Solr does not call PropertyUtilsBean.getProperty(),
BeanUtilsBean, or any Commons BeanUt [...]
+ "status_notes": "Affected Apache Solr versions: 3.6.0-10.0.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2026-33870",
+ "aliases": [
+ "CVE-2026-33871"
+ ]
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-07-18T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "CVE-2026-33870 is an HTTP/1.1 request smuggling
vulnerability via malformed chunked transfer encoding extension values in
Netty's server-side HTTP codec. CVE-2026-33871 is an HTTP/2 CONTINUATION frame
flood DoS against a Netty HTTP/2 server. Both require Netty to be used as an
HTTP server accepting connections from untrusted clients. In Solr, Netty is a
transitive dependency (via ZooKeeper 3.9.x and optionally the OpenTelemetry
OTLP exporter); it is used exclus [...]
+ "status_notes": "Affected Apache Solr versions: 9.2.0-10.0.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2026-41417"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-07-18T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "CVE-2026-41417 (CVSS 5.3) is a request-smuggling
issue (CWE-93 / CWE-444) in Netty's HTTP/1.1\ncodec. `DefaultHttpRequest` and
`DefaultFullHttpRequest` reject CRLF and whitespace characters in\ntheir
constructors, but the `setUri()` method that lets a request's URI be rewritten
after\nconstruction has no equivalent validation, so an attacker who controls a
value later passed to\n`setUri()` can inject CRLF sequences and smuggle a
second request. It affects Netty [...]
+ "status_notes": "Affected Apache Solr versions: 9.2.0-9.10.x,10.0.x."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2026-42577"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-07-18T00:00:00Z",
+ "impact_statement": "CVE-2026-42577 (CVSS 7.5, CWE-772) is a
resource-leak / denial-of-service issue in Netty's Epoll\nnative transport: a
TCP connection that receives a RST after being half-closed isn't
properly\nclosed, so stale channels accumulate and can eventually pin the
owning event-loop thread at 100%\nCPU. It affects Netty 4.2.0.Final up to (but
not including) 4.2.13.Final \u2014 the Epoll transport code\nin question was
introduced by the 4.2 rewrite, so the older 4.1.x li [...]
+ "status_notes": "Affected Apache Solr versions: 9.10.x,10.0.x."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2026-42578"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-07-18T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "CVE-2026-42578 (CVSS 7.5, CWE-93 / CWE-113) is a
header-injection issue in\n`io.netty:netty-handler-proxy`'s `HttpProxyHandler`,
used when a Netty client tunnels a connection\nthrough an HTTP proxy via
CONNECT. Its `newInitialMessage()` method builds the CONNECT request's\nheaders
with validation explicitly disabled
(`DefaultHttpHeadersFactory...withValidation(false)`),\nthen appends the
caller-supplied `outboundHeaders` without any CRLF check \u2014 so an atta [...]
+ "status_notes": "Affected Apache Solr versions: 9.2.0-9.10.x,10.0.x."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2026-42580"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-07-18T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "CVE-2026-42580 (CVSS 6.5, CWE-190 / CWE-444) is a
request-smuggling issue in `netty-codec-http`'s\n`HttpObjectDecoder`: when
parsing a chunked HTTP/1.1 message, the hex chunk-size field is parsed\ninto a
32-bit int without an overflow check, so an oversized chunk-size value silently
wraps\naround to a small (or negative) number instead of being rejected. A
crafted chunk whose declared\nsize doesn't match the bytes actually sent can
desynchronize how Netty and a [...]
+ "status_notes": "Affected Apache Solr versions: 9.2.0-9.10.x,10.0.x."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2026-42581"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-07-18T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "CVE-2026-42581 (CWE-444) is a request-smuggling
issue in `netty-codec-http`'s\n`HttpObjectDecoder`: for an HTTP/1.0 request
that carries both `Transfer-Encoding: chunked` and a\n`Content-Length` header,
the decoder fails to strip the conflicting `Content-Length`, so\ndownstream
proxies or handlers that pick a different header to trust can disagree with
Netty about\nwhere the request body ends. It affects Netty before 4.1.133.Final
and 4.2.0.Alpha1\u20134.2.12.F [...]
+ "status_notes": "Affected Apache Solr versions: 9.2.0-9.10.x,10.0.x."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2026-42583"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-07-18T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "CVE-2026-42583 (CVSS 7.5, CWE-400 / CWE-770) is a
resource-exhaustion issue in\n`netty-codec-compression`'s `Lz4FrameDecoder`: it
allocates a `ByteBuf` sized to the frame's\nclaimed `decompressedLength` (up to
32 MB per block) *before* running LZ4 decompression, so a\ncrafted frame that
lies about its decompressed size can force large allocations regardless of
how\nmuch data was actually sent \u2014 a decompression-bomb-style DoS. It
affects Netty before\n4.1.1 [...]
+ "status_notes": "Affected Apache Solr versions: 9.10.x,10.0.x."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2026-42584"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-07-18T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "CVE-2026-42584 (CVSS up to 9.1, CWE-444) is a
request-smuggling issue in `netty-codec-http`'s\n`HttpClientCodec`: it pairs
each inbound response with the next outbound request by calling\n`queue.poll()`
exactly once per response, including for 1xx informational responses. When a
server\nsends a 1xx response ahead of the real final response, the codec's
request/response pairing slips,\nand a later response's body gets parsed from
the wrong offset. It affects Net [...]
+ "status_notes": "Affected Apache Solr versions: 9.2.0-9.10.x,10.0.x."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2026-42585"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-07-18T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "CVE-2026-42585 (CWE-444) is a request-smuggling
issue in `netty-codec-http`'s HTTP/1.x\ndecoder: a malformed
`Transfer-Encoding` header value is parsed incorrectly, so Netty and
a\nfront-end HTTP intermediary can disagree about whether a request is chunked.
It affects Netty\nbefore 4.1.133.Final and 4.2.0.Alpha1\u20134.2.12.Final;
fixed in 4.1.133.Final and 4.2.13.Final.\n\nSolr has shipped a vulnerable
`netty-codec-http` since 9.2.0 (4.1.x through 9.9.0, 4.2.x [...]
+ "status_notes": "Affected Apache Solr versions: 9.2.0-9.10.x,10.0.x."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2026-42587"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-07-18T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "CVE-2026-42587 (CVSS 7.5, CWE-400 / CWE-770) is a
resource-exhaustion issue in `netty-codec-http`'s\n`HttpContentDecompressor`:
its `maxAllocation` parameter, meant to cap decompression-buffer size\nand
prevent decompression-bomb attacks, is correctly enforced for `gzip`/`deflate`
(via\n`ZlibDecoder`) but silently ignored for `br` (Brotli), `zstd`, and
`snappy` content encodings \u2014 so\na compressed body using one of those
encodings can bypass the limit and [...]
+ "status_notes": "Affected Apache Solr versions: 9.2.0-9.10.x,10.0.x."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2026-44249"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-07-18T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "CVE-2026-44249 (CVSS 8.1, CWE-284 / CWE-697 /
CWE-1287) is an access-control bypass in\n`netty-handler`'s
`IpSubnetFilterRule.compareTo()`: an incorrect IPv6 masking operation lets
a\nvalid public IPv6 address slip past a configured subnet allow/deny rule.
`IpSubnetFilterRule` (and\nthe `RuleBasedIpFilter` that uses it) is a
server-side feature an application installs in a Netty\npipeline to accept or
reject *inbound* connections by source IP. It affects Netty [...]
+ "status_notes": "Affected Apache Solr versions: 8.3.0-9.10.x,10.0.x."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2026-45416"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-07-18T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "CVE-2026-45416 (CVSS 7.5, CWE-770) is a
resource-exhaustion issue in
`netty-handler`'s\n`SslClientHelloHandler.decode()`: it reads the 24-bit TLS
handshake length from an inbound\nClientHello and eagerly allocates a buffer
sized to it without a configured limit\n(`maxClientHelloLength` defaults to
`0`, meaning unlimited), so a crafted ~16 MiB ClientHello can\nforce a huge,
unpooled allocation. This only matters for applications using `SniHandler`
(or\n`Abstract [...]
+ "status_notes": "Affected Apache Solr versions: 8.6.0-9.10.x,10.0.x."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2026-45536"
+ },
+ "products": [
+ {
+ "@id":
"pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id":
"pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id":
"pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id":
"pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id":
"pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id":
"pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id":
"pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id":
"pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id":
"pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id":
"pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id":
"pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id":
"pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id":
"pkg:maven/io.netty/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-07-18T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "CVE-2026-45536 (CVSS 4.0, CWE-200 / CWE-772) is a
file-descriptor leak in the native/JNI code\nbacking
`netty-transport-native-unix-common`: `netty_unix_socket_recvFd` allocates only
24 bytes\nfor the ancillary-data control message, so when a peer sends an
`SCM_RIGHTS` message carrying two\nfile descriptors over a Unix domain socket,
the kernel installs both fds but Netty's code only\naccounts for one, leaking
the other on every such message. Its CVSS vector is [...]
+ "status_notes": "Affected Apache Solr versions: 8.3.0-9.10.x,10.0.x."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2026-47244"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-07-18T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "CVE-2026-47244 (CVSS 5.3, CWE-400) is a
resource-exhaustion issue in
`netty-codec-http2`:\n`DefaultHttp2Connection.DefaultEndpoint` initializes
`maxActiveStreams`/`maxStreams` to\n`Integer.MAX_VALUE`, and `Http2Settings`
doesn't enforce `SETTINGS_MAX_CONCURRENT_STREAMS` unless\nan application
explicitly configures it. A peer can open hundreds of thousands of stream
objects on\na single TCP connection, the same amplification pattern as the 2023
HTTP/2 \"Rapid Re [...]
+ "status_notes": "Affected Apache Solr versions: 9.2.0-9.10.x,10.0.x."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2026-47691"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.apache.solr/solr-core"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-07-18T00:00:00Z",
+ "justification": "vulnerable_code_not_present",
+ "impact_statement": "CVE-2026-47691 (CVSS up to 10.0, CWE-345 / CWE-346)
is a DNS cache-poisoning issue in Netty's\nasynchronous DNS resolver
(`io.netty:netty-resolver-dns`): it accepts any NS record from a
DNS\nresponse's AUTHORITY section as long as its name is a suffix of the
question name, without properly\nvalidating that the record is actually in that
nameserver's bailiwick, then caches the associated A\nrecords directly. An
attacker who controls an authoritative nameserver f [...]
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2026-48043"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-07-18T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "CVE-2026-48043 (CVSS up to 7.5, CWE-400 / CWE-401 /
CWE-772) is a resource-leak issue in\n`netty-codec-http2`'s
`DelegatingDecompressorFrameListener`: it decompresses
`gzip`/`deflate`/`zstd`\nHTTP/2 message bodies using a per-stream embedded
channel, but when a flow-controller exception\noccurs, the pooled `ByteBuf`s
involved aren't released \u2014 repeated triggering leaks pooled memory\nand
can eventually crash the JVM with an OOM. `DelegatingDecompressorFram [...]
+ "status_notes": "Affected Apache Solr versions: 9.2.0-9.10.x,10.0.x."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2026-50010"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-07-18T00:00:00Z",
+ "impact_statement": "CVE-2026-50010 (CVSS 7.5, CWE-347) is a TLS
hostname-verification bypass in `netty-handler`:\n`SimpleTrustManagerFactory`
wraps a user-supplied `X509TrustManager` in an adapter that
extends\n`X509ExtendedTrustManager` (required by the JDK's `SSLEngine`) but
discards the `SSLEngine`\nparameters during certificate validation. Because
those parameters carry the endpoint identity\nJava uses for hostname checking,
wrapping a *custom* trust manager this way silently [...]
+ "status_notes": "Affected Apache Solr versions: 8.3.0-9.10.x,10.0.x."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2026-50020"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-07-18T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "CVE-2026-50020 (CVSS 5.3, CWE-444) is a
request-smuggling issue in `netty-codec-http`'s\n`HttpObjectDecoder`: before
parsing a request line, it skips leading control characters\n(0x00\u20130x1F
and 0x7F) and whitespace, more permissive than RFC 9112, which only allows
ignoring an\nempty leading CRLF. This over-tolerant framing can let a crafted
request boundary be interpreted\ndifferently by Netty than by a front-end
intermediary. It affects Netty before 4.1.13 [...]
+ "status_notes": "Affected Apache Solr versions: 9.2.0-9.10.x,10.0.x."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2026-50560"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-07-18T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "CVE-2026-50560 (CVSS 5.3, CWE-770) is a
resource-exhaustion issue in `netty-codec-http2`, in the\nsame \"HTTP/2 Rapid
Reset\" family of attacks as the 2023 stream-reset issue (CVE-2023-44487)
but\nwith a different trigger: a client that advertises
`SETTINGS_MAX_HEADER_LIST_SIZE` can cause the\nserver to read a request, start
proxying/processing it, attempt to generate a response, and then\nthrow an
exception while writing the response headers \u2014 repeating t [...]
+ "status_notes": "Affected Apache Solr versions: 9.2.0-9.10.x,10.0.x."
+ },
+ {
+ "vulnerability": {
+ "name": "GHSA-72hv-8253-57qq"
+ },
+ "products": [
+ {
+ "@id": "jackson-core-2.20.0.jar"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-07-18T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "GHSA-72hv-8253-57qq is a DoS vulnerability in the
non-blocking (async) JSON parser API of jackson-core
(NonBlockingByteArrayJsonParser), which bypasses the maxNumberLength
constraint. Exploitation requires an application to use the async/non-blocking
parser API (factory.createNonBlockingByteArrayParser()). Solr uses the standard
synchronous Jackson parser to deserialize JSON from HTTP request bodies and
internal data structures. Solr is built on Jetty with sync [...]
+ "status_notes": "Affected Apache Solr versions: 4.7.0-10.0.0."
+ }
+ ]
+}
\ No newline at end of file
diff --git a/output/solr.vex.json b/output/solr.vex.json
index ff8db7455..534f3f121 100644
--- a/output/solr.vex.json
+++ b/output/solr.vex.json
@@ -7,7 +7,7 @@
"name": "solr",
"version": "SNAPSHOT",
"type": "application",
- "bom-ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "bom-ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
},
"vulnerabilities": [
@@ -23,7 +23,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -39,7 +39,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -55,7 +55,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -71,7 +71,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -87,7 +87,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -103,7 +103,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -119,7 +119,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -135,7 +135,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -151,7 +151,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -167,7 +167,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -183,7 +183,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -199,7 +199,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -215,7 +215,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -231,7 +231,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -247,7 +247,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -263,7 +263,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -279,7 +279,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -295,7 +295,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -311,7 +311,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -327,7 +327,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -343,7 +343,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -359,7 +359,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -375,7 +375,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -391,7 +391,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -407,7 +407,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -423,7 +423,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -439,7 +439,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -455,7 +455,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -471,7 +471,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -487,7 +487,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -503,7 +503,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -519,7 +519,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -535,7 +535,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -551,7 +551,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -567,7 +567,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -583,7 +583,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -599,7 +599,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -615,7 +615,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -631,7 +631,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -647,7 +647,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -663,7 +663,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -679,7 +679,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -695,7 +695,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -711,7 +711,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -727,7 +727,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -743,7 +743,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -759,7 +759,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -775,7 +775,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -791,7 +791,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -807,7 +807,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -823,7 +823,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -839,7 +839,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -855,7 +855,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -871,7 +871,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -887,7 +887,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -903,7 +903,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -919,7 +919,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -935,7 +935,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -951,7 +951,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -970,7 +970,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -986,7 +986,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1002,7 +1002,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1018,7 +1018,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1037,7 +1037,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1053,7 +1053,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1070,7 +1070,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1086,7 +1086,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1103,7 +1103,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1120,7 +1120,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1137,7 +1137,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1154,7 +1154,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1171,7 +1171,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1188,7 +1188,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1208,7 +1208,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1228,7 +1228,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1248,7 +1248,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1265,7 +1265,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1285,7 +1285,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1302,7 +1302,58 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
+ }
+ ]
+ },
+ {
+ "id": "CVE-2025-48734",
+ "source": {
+ "name": "NVD",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48734";
+ },
+ "analysis": {
+ "state": "not_affected",
+ "justification": "code_not_reachable",
+ "detail": "CVE-2025-48734 allows an attacker to access the JVM
ClassLoader (and potentially execute arbitrary code) by passing a property path
containing 'declaredClass' to PropertyUtilsBean.getProperty() or
getNestedProperty(). Exploitation requires an application to pass externally
supplied property path strings to these BeanUtils methods. A search of the Solr
codebase confirms that Solr does not call PropertyUtilsBean.getProperty(),
BeanUtilsBean, or any Commons BeanUtils intr [...]
+ },
+ "affects": [
+ {
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
+ }
+ ]
+ },
+ {
+ "id": "CVE-2026-33870",
+ "source": {
+ "name": "NVD",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33870";
+ },
+ "analysis": {
+ "state": "not_affected",
+ "justification": "code_not_reachable",
+ "detail": "CVE-2026-33870 is an HTTP/1.1 request smuggling
vulnerability via malformed chunked transfer encoding extension values in
Netty's server-side HTTP codec. CVE-2026-33871 is an HTTP/2 CONTINUATION frame
flood DoS against a Netty HTTP/2 server. Both require Netty to be used as an
HTTP server accepting connections from untrusted clients. In Solr, Netty is a
transitive dependency (via ZooKeeper 3.9.x and optionally the OpenTelemetry
OTLP exporter); it is used exclusively as [...]
+ },
+ "affects": [
+ {
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
+ }
+ ]
+ },
+ {
+ "id": "CVE-2026-33871",
+ "source": {
+ "name": "NVD",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33871";
+ },
+ "analysis": {
+ "state": "not_affected",
+ "justification": "code_not_reachable",
+ "detail": "CVE-2026-33870 is an HTTP/1.1 request smuggling
vulnerability via malformed chunked transfer encoding extension values in
Netty's server-side HTTP codec. CVE-2026-33871 is an HTTP/2 CONTINUATION frame
flood DoS against a Netty HTTP/2 server. Both require Netty to be used as an
HTTP server accepting connections from untrusted clients. In Solr, Netty is a
transitive dependency (via ZooKeeper 3.9.x and optionally the OpenTelemetry
OTLP exporter); it is used exclusively as [...]
+ },
+ "affects": [
+ {
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1319,7 +1370,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1336,7 +1387,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1353,7 +1404,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1370,7 +1421,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1387,7 +1438,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1404,7 +1455,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1421,7 +1472,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1438,7 +1489,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1455,7 +1506,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1472,7 +1523,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1489,7 +1540,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1506,7 +1557,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1523,7 +1574,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1540,7 +1591,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1557,7 +1608,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1574,7 +1625,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1591,7 +1642,7 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
},
@@ -1608,7 +1659,24 @@
},
"affects": [
{
- "ref": "adcd1165-7a38-553a-9994-8bd9fb883970"
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
+ }
+ ]
+ },
+ {
+ "id": "GHSA-72hv-8253-57qq",
+ "source": {
+ "name": "GITHUB",
+ "url": "https://github.com/advisories/GHSA-72hv-8253-57qq";
+ },
+ "analysis": {
+ "state": "not_affected",
+ "justification": "code_not_reachable",
+ "detail": "GHSA-72hv-8253-57qq is a DoS vulnerability in the
non-blocking (async) JSON parser API of jackson-core
(NonBlockingByteArrayJsonParser), which bypasses the maxNumberLength
constraint. Exploitation requires an application to use the async/non-blocking
parser API (factory.createNonBlockingByteArrayParser()). Solr uses the standard
synchronous Jackson parser to deserialize JSON from HTTP request bodies and
internal data structures. Solr is built on Jetty with synchronous [...]
+ },
+ "affects": [
+ {
+ "ref": "ec572863-4dd1-5f75-a901-ba21a0c46c39"
}
]
}
diff --git a/output/vex.html b/output/vex.html
index 938c5f875..ab798510d 100644
--- a/output/vex.html
+++ b/output/vex.html
@@ -142,6 +142,30 @@
<h1>Apache Solr VEX</h1>
<p><a href="/security-dependency-cves.html">← Back to the dependency
CVE table</a></p>
+ <article id="ghsa-72hv-8253-57qq" class="post panel radius">
+ <header class="post-header">
+ <h3 class="title"><a
href="https://github.com/advisories/GHSA-72hv-8253-57qq";>GHSA-72hv-8253-57qq</a>,
Jackson-core: async (non-blocking) parser bypasses maxNumberLength (DoS)</h3>
+ <div class="panel callout">
+ <p class="subheader">
+ <strong>Status:</strong>
+ <span class="cdx-not-affected">not_affected</span>
+ </p>
+ <p class="subheader"><strong>Affected Solr
versions:</strong> 4.7.0-10.0.0</p>
+ </div>
+ </header>
+
+ <h4>Description</h4>
+ <p>GHSA-72hv-8253-57qq is a DoS vulnerability in the
non-blocking (async) JSON parser API of jackson-core
(NonBlockingByteArrayJsonParser), which bypasses the maxNumberLength
constraint. Exploitation requires an application to use the async/non-blocking
parser API (factory.createNonBlockingByteArrayParser()). Solr uses the standard
synchronous Jackson parser to deserialize JSON from HTTP request bodies and
internal data structures. Solr is built on Jetty with synchronous [...]
+<p>GHSA-72hv-8253-57qq affects jackson-core releases before 2.18.6 and the
2.19.0 through 2.21.0 line
+(fixed in 2.18.6 and 2.21.1). Solr has bundled jackson-core (alongside
<code>jackson-databind</code>, which it
+ships in lockstep with) since Solr 4.7.0, and every release through 10.0.0
ships an affected version
+(2.3.1 through 2.18.0, then 2.20.0). The affected range is therefore 4.7.0 –
10.0.0.</p>
+
+ <h4>References</h4>
+ <ul>
+ <li>CVE: <a
href="https://github.com/advisories/GHSA-72hv-8253-57qq";>GHSA-72hv-8253-57qq</a></li>
+ </ul>
+ </article>
<article id="cve-2026-50560" class="post panel radius">
<header class="post-header">
<h3 class="title"><a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-50560";>CVE-2026-50560</a>,
Netty: HTTP/2 max-header-size handling enables Rapid-Reset-style DoS</h3>
@@ -1065,6 +1089,55 @@ fixed — and will be released in Solr versions 9.11.0 and
10.1.</p>
<li>CVE: <a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-41417";>CVE-2026-41417</a></li>
</ul>
</article>
+ <article id="cve-2026-33870" class="post panel radius">
+ <header class="post-header">
+ <h3 class="title"><a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-33870";>CVE-2026-33870</a>, <a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-33871";>CVE-2026-33871</a>,
Netty: HTTP/1.1 request smuggling and HTTP/2 CONTINUATION-flood DoS
(server-side codec)</h3>
+ <div class="panel callout">
+ <p class="subheader">
+ <strong>Status:</strong>
+ <span class="cdx-not-affected">not_affected</span>
+ </p>
+ <p class="subheader"><strong>Affected Solr
versions:</strong> 9.2.0-10.0.0</p>
+ </div>
+ </header>
+
+ <h4>Description</h4>
+ <p>CVE-2026-33870 is an HTTP/1.1 request smuggling
vulnerability via malformed chunked transfer encoding extension values in
Netty's server-side HTTP codec. CVE-2026-33871 is an HTTP/2 CONTINUATION frame
flood DoS against a Netty HTTP/2 server. Both require Netty to be used as an
HTTP server accepting connections from untrusted clients. In Solr, Netty is a
transitive dependency (via ZooKeeper 3.9.x and optionally the OpenTelemetry
OTLP exporter); it is used exclusively as [...]
+<p>Both CVEs affect Netty releases before 4.1.132 and 4.2.0 through 4.2.9.
Solr has bundled the modular
+<code>netty-codec-http</code> / <code>netty-codec-http2</code> artifacts
(transitively, via ZooKeeper and the optional
+OpenTelemetry OTLP exporter) since Solr 9.2.0 — earlier releases used the
<code>netty-all</code> uber-jar — and
+every release from 9.2.0 through 10.0.0 ships an affected version
(4.1.89.Final through 4.2.6.Final).
+The affected range is therefore 9.2.0 – 10.0.0.</p>
+
+ <h4>References</h4>
+ <ul>
+ <li>CVE: <a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-33870";>CVE-2026-33870</a>, <a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-33871";>CVE-2026-33871</a></li>
+ </ul>
+ </article>
+ <article id="cve-2025-48734" class="post panel radius">
+ <header class="post-header">
+ <h3 class="title"><a
href="https://nvd.nist.gov/vuln/detail/CVE-2025-48734";>CVE-2025-48734</a>,
Apache Commons BeanUtils: class-loader access via a 'declaredClass' property
path</h3>
+ <div class="panel callout">
+ <p class="subheader">
+ <strong>Status:</strong>
+ <span class="cdx-not-affected">not_affected</span>
+ </p>
+ <p class="subheader"><strong>Affected Solr
versions:</strong> 3.6.0-10.0.0</p>
+ </div>
+ </header>
+
+ <h4>Description</h4>
+ <p>CVE-2025-48734 allows an attacker to access the JVM
ClassLoader (and potentially execute arbitrary code) by passing a property path
containing 'declaredClass' to PropertyUtilsBean.getProperty() or
getNestedProperty(). Exploitation requires an application to pass externally
supplied property path strings to these BeanUtils methods. A search of the Solr
codebase confirms that Solr does not call PropertyUtilsBean.getProperty(),
BeanUtilsBean, or any Commons BeanUtils intr [...]
+<p>CVE-2025-48734 affects all Commons BeanUtils 1.x releases before 1.11.0.
Solr has bundled
+commons-beanutils since Solr 3.6.0, and every release that includes it,
through Solr 10.0.0, ships an
+affected 1.x version (1.7.0, then 1.8.3, 1.9.3 and 1.9.4 — all below 1.11.0).
The affected range is
+therefore 3.6.0 – 10.0.0.</p>
+
+ <h4>References</h4>
+ <ul>
+ <li>CVE: <a
href="https://nvd.nist.gov/vuln/detail/CVE-2025-48734";>CVE-2025-48734</a></li>
+ </ul>
+ </article>
<article id="cve-2026-5795" class="post panel radius">
<header class="post-header">
<h3 class="title"><a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-5795";>CVE-2026-5795</a>,
Eclipse Jetty: privilege escalation via uncleared JASPI ThreadLocals</h3>
