This is an automated email from the ASF dual-hosted git repository.
github-actions[bot] pushed a commit to branch asf-staging
in repository https://gitbox.apache.org/repos/asf/solr-site.git
The following commit(s) were added to refs/heads/asf-staging by this push:
new 7a8c769b2 Commit build products
7a8c769b2 is described below
commit 7a8c769b2a209fee96b5d91cbf97546b4fd1be2b
Author: Build Pelican (action) <[email protected]>
AuthorDate: Thu Aug 13 01:17:02 2026 +0000
Commit build products
---
output/feeds/all.atom.xml | 88 ++++++---
output/feeds/solr/vex.atom.xml | 61 +++++-
output/security-dependency-cves.html | 36 ++++
output/solr.openvex.json | 127 +++++++++++-
output/solr.vex.json | 373 +++++++++++++++++++++--------------
output/vex.html | 150 +++++++++++++-
6 files changed, 656 insertions(+), 179 deletions(-)
diff --git a/output/feeds/all.atom.xml b/output/feeds/all.atom.xml
index 3087278c0..ca60fe072 100644
--- a/output/feeds/all.atom.xml
+++ b/output/feeds/all.atom.xml
@@ -18,7 +18,9 @@ avro &lt; 1.11.3). Both require the application to feed
attacker-controlled
input.</li>
</ul>
<p>The affected range covers the 9.x line, where the optional Hadoop
modules transitively carry Avro
-1.9.2; Solr's own code path never invokes it.</p></content><category
term="solr/vex"/></entry><entry><title>jackson-core: memory disclosure via
source snippet in JsonLocation error messages</title><link
href="/cve-2025-49128.html"
rel="alternate"/><published>2026-07-31T00:00:00+00:00</published><updated>2026-07-31T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-07-31:/cve-2025-49128.html</id><summary
type="html"><p>CVE-2025-49128 can dis [...]
+1.9.2; Solr's own code path never invokes it. A scanner surfaces this as
<code>[email protected]</code> because Avro is
+shaded inside <code>hadoop-client-runtime-3.4.0.jar</code> in the
<code>hdfs</code> module (this is the form reported by
+SOLR-17900); it is the same non-reachable Hadoop transitive either
way.</p></content><category
term="solr/vex"/></entry><entry><title>jackson-core: memory disclosure via
source snippet in JsonLocation error messages</title><link
href="/cve-2025-49128.html"
rel="alternate"/><published>2026-07-31T00:00:00+00:00</published><updated>2026-07-31T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-07-31:/cve-2025-49128.html</id><summary
type="html"><p [...]
includes in <code>JsonLocation</code> (e.g. surfaced in
parse-error messages). It affects jackson-core &lt; 2.13.0.</p>
<p>Solr is <strong>not affected</strong>. Solr's own
jackson-core is 2.18.0 in current 9.x and 2.22.0 in 9.11 — both
…</p></summary><content type="html"><p>CVE-2025-49128 can disclose
adjacent buffer memory through the source snippet that jackson-core
includes in <code>JsonLocation</code> (e.g. surfaced in
parse-error messages). It affects jackson-core &lt; 2.13.0.</p>
@@ -1528,7 +1530,20 @@ in any of the ways these CVEs require:</p>
below the fixed 1.74/1.78. Solr 10.0.0 upgraded the extraction stack to Tika
3.x, whose PDFBox no
longer bundles Bouncy Castle, so 10.x ships no <code>bcprov</code>
at all. The affected range is therefore
7.3.0 – 9.10.1. (Solr 9.5–9.6 also briefly bundled a separate
<code>bcprov-jdk18on</code> 1.77 for another
-module, fixed to 1.78.1 in 9.7; the same not-affected reasoning
applies.)</p></content><category
term="solr/vex"/></entry><entry><title>Apache James MIME4J: header injection
when composing MIME messages</title><link href="/cve-2024-21742.html"
rel="alternate"/><published>2025-09-07T00:00:00+00:00</published><updated>2025-09-07T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2025-09-07:/cve-2024-21742.html</id><summary
type="html"><p>CVE-2024- [...]
+module, fixed to 1.78.1 in 9.7; the same not-affected reasoning
applies.)</p></content><category
term="solr/vex"/></entry><entry><title>Nimbus JOSE + JWT: denial of service
parsing crafted JOSE objects</title><link href="/cve-2023-52428.html"
rel="alternate"/><published>2025-09-07T00:00:00+00:00</published><updated>2025-09-07T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2025-09-07:/cve-2023-52428.html</id><summary
type="html"><p>CVE-2023-5 [...]
+object (for example a PBES2-encrypted JWE with a huge
<code>p2c</code> iteration count, or a large deeply-nested
+structure) can consume excessive resources (fixed in 9.37.2). It is only
reachable when an
+application parses …</p></summary><content
type="html"><p>CVE-2023-52428 (CVSS 8.7) is a denial-of-service issue in
Nimbus JOSE + JWT: parsing a crafted JOSE
+object (for example a PBES2-encrypted JWE with a huge
<code>p2c</code> iteration count, or a large deeply-nested
+structure) can consume excessive resources (fixed in 9.37.2). It is only
reachable when an
+application parses attacker-supplied JOSE/JWT input with Nimbus.</p>
+<p>Solr is <strong>not affected</strong>. Solr's own JWT
authentication (the optional <code>jwt-auth</code> module,
+<code>JWTAuthPlugin</code>) parses tokens with
<strong>jose4j</strong>, not Nimbus (see CVE-2025-53864). The
Nimbus copy a
+scanner flags (<code>[email protected]</code>) is shaded inside
<code>hadoop-client-runtime</code> in the optional
+<code>hdfs</code> module and is only used by Hadoop's own internal
auth machinery — Solr never routes an
+untrusted, externally-supplied JOSE object to it. The vulnerable parser is
therefore not reached. The
+affected range spans the releases whose <code>hdfs</code> module
bundles the affected shaded Nimbus (Solr
+9.0.0 – 9.10.1); Solr 10.x ships no
<code>hadoop-client-runtime</code>.</p></content><category
term="solr/vex"/></entry><entry><title>Apache James MIME4J: header injection
when composing MIME messages</title><link href="/cve-2024-21742.html"
rel="alternate"/><published>2025-09-07T00:00:00+00:00</published><updated>2025-09-07T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2025-09-07:/cve-2024-21742.html</id><summary
type="html"><p> [...]
used to <strong>compose / write</strong> MIME messages, improper
input validation lets crafted field values inject
unintended headers into the produced message. It affects
<code>apache-mime4j</code> before 0.8.10 (fixed in
0.8.10), and is …</p></summary><content
type="html"><p>CVE-2024-21742 (CVSS 5.3) is a header-injection issue in
Apache James MIME4J: when the library is
@@ -1545,7 +1560,47 @@ regardless of whether the (non-default,
not-recommended-for-production) Solr Cel
3.6.0 – 9.10.1, but the composition code path this CVE requires is not
exercised in any of them.
Operators who run Solr Cell can additionally follow the project's guidance to
perform document
extraction in a separate Tika service, or replace
<code>modules/extraction/lib/apache-mime4j-*.jar</code> with
-0.8.10 or later.</p></content><category
term="solr/vex"/></entry><entry><title>Apache POI: improper input validation
parsing OOXML files</title><link href="/cve-2025-31672.html"
rel="alternate"/><published>2025-09-07T00:00:00+00:00</published><updated>2025-09-07T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2025-09-07:/cve-2025-31672.html</id><summary
type="html"><p>CVE-2025-31672 (CVSS 6.9) is an improper-input-validation
issue in Apache P [...]
+0.8.10 or later.</p></content><category
term="solr/vex"/></entry><entry><title>dnsjava: DNSSEC validation
bypass</title><link href="/cve-2024-25638.html"
rel="alternate"/><published>2025-09-07T00:00:00+00:00</published><updated>2025-09-07T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2025-09-07:/cve-2024-25638.html</id><summary
type="html"><p>CVE-2024-25638 (CVSS 7.0) is a DNSSEC-validation bypass
in dnsjava: a resolver relying on dnsjava to
+validate DNSSEC could be tricked into accepting spoofed records (affects
dnsjava &lt; 3.6.0). It matters
+only for an application that uses dnsjava as its resolver and relies on its
DNSSEC validation for a …</p></summary><content
type="html"><p>CVE-2024-25638 (CVSS 7.0) is a DNSSEC-validation bypass in
dnsjava: a resolver relying on dnsjava to
+validate DNSSEC could be tricked into accepting spoofed records (affects
dnsjava &lt; 3.6.0). It matters
+only for an application that uses dnsjava as its resolver and relies on its
DNSSEC validation for a
+security decision.</p>
+<p>Solr is <strong>not affected</strong>. dnsjava is not a
Solr dependency in its own right — it is shaded inside
+<code>hadoop-client-runtime</code> (reported by scanners as
<code>[email protected]</code>) in the optional
<code>hdfs</code> module,
+where Hadoop may use it for name resolution. Solr uses the HDFS module only as
a <strong>client</strong> that
+connects to operator-configured HDFS NameNode/DataNode hosts, not
attacker-controlled names, and it
+does not rely on dnsjava's DNSSEC validation to make any security decision.
The vulnerable resolver
+path is therefore not reached. The affected range spans the releases whose
<code>hdfs</code> module bundles an
+affected shaded dnsjava (Solr 9.0.0 – 9.10.1); Solr 10.x ships no
<code>hadoop-client-runtime</code>.</p></content><category
term="solr/vex"/></entry><entry><title>Apache Commons Compress:
OutOfMemoryError unpacking a broken Pack200 file</title><link
href="/cve-2024-26308.html"
rel="alternate"/><published>2025-09-07T00:00:00+00:00</published><updated>2025-09-07T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2025-09-07:/cve-2024-26308.h [...]
+malformed <strong>Pack200</strong>
(<code>.pack</code>/<code>.pack.gz</code>) stream can
allocate excessive memory and throw
+<code>OutOfMemoryError</code> (affects 1.21 through 1.25.0, fixed
in 1.26.0). It is reachable only when an
+application uses Commons Compress to …</p></summary><content
type="html"><p>CVE-2024-26308 (CVSS 6.7) is a denial-of-service issue in
Apache Commons Compress: unpacking a
+malformed <strong>Pack200</strong>
(<code>.pack</code>/<code>.pack.gz</code>) stream can
allocate excessive memory and throw
+<code>OutOfMemoryError</code> (affects 1.21 through 1.25.0, fixed
in 1.26.0). It is reachable only when an
+application uses Commons Compress to unpack an attacker-supplied Pack200
archive.</p>
+<p>Solr is <strong>not affected</strong>. Solr never unpacks
Pack200 archives — Pack200 (a legacy JAR-compression
+format) is not part of any Solr request path. The affected
<code>commons-compress</code> a scanner flags
+(<code>[email protected]</code>) is the copy shaded into
<code>hadoop-client-runtime</code> in the optional
<code>hdfs</code>
+module; Solr's HDFS-client usage does not feed untrusted Pack200 input to it,
and Solr's own use of
+Commons Compress elsewhere does not invoke the Pack200 unpacker. The
vulnerable code path is therefore
+not reached. The affected range spans the releases whose
<code>hdfs</code> module bundles an affected shaded
+commons-compress (Solr 9.0.0 – 9.10.1); Solr 10.x ships no
<code>hadoop-client-runtime</code>.</p></content><category
term="solr/vex"/></entry><entry><title>Apache Commons Configuration:
StackOverflowError in list-delimiter handling</title><link
href="/cve-2024-29131.html"
rel="alternate"/><published>2025-09-07T00:00:00+00:00</published><updated>2025-09-07T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2025-09-07:/cve-2024-29131.html</ [...]
+Configuration's list-delimiter handling —
<code>AbstractListDelimiterHandler.flattenIterator(...)</code> and
+<code>ListDelimiterHandler.flatten(Object, int)</code>
respectively — when a configuration contains a cyclic
+reference (both affect 2.0 through 2.10.0, fixed in 2.10.1).</p>
+<p>Solr is <strong>not affected</strong>. Solr uses
<code>commons-configuration2</code> only through
…</p></summary><content type="html"><p>CVE-2024-29131 and
CVE-2024-29133 are denial-of-service issues (StackOverflowError) in Apache
Commons
+Configuration's list-delimiter handling —
<code>AbstractListDelimiterHandler.flattenIterator(...)</code> and
+<code>ListDelimiterHandler.flatten(Object, int)</code>
respectively — when a configuration contains a cyclic
+reference (both affect 2.0 through 2.10.0, fixed in 2.10.1).</p>
+<p>Solr is <strong>not affected</strong>. Solr uses
<code>commons-configuration2</code> only through its optional Hadoop
+integration — both the standalone copy in the
<code>hadoop-auth</code> module and the copy shaded into
+<code>hadoop-client-runtime</code> (which a scanner reports as
<code>[email protected]</code>) — to load
+<strong>administrator-supplied</strong> Hadoop configuration
files, never untrusted external input. No Solr request
+path feeds attacker-controlled configuration to Commons Configuration, so the
recursive list-delimiter
+parser cannot be driven by an adversary. This matches the existing assessment
of the other Commons
+Configuration CVEs (CVE-2022-33980, CVE-2026-45205). The affected range spans
the releases whose
+Hadoop modules carry an affected commons-configuration2 (Solr 9.0.0 –
9.10.1).</p></content><category
term="solr/vex"/></entry><entry><title>Apache POI: improper input validation
parsing OOXML files</title><link href="/cve-2025-31672.html"
rel="alternate"/><published>2025-09-07T00:00:00+00:00</published><updated>2025-09-07T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2025-09-07:/cve-2025-31672.html</id><summary
type="html"><p>CVE-2025-3167 [...]
a crafted OOXML file (<code>.xlsx</code>,
<code>.docx</code>, etc.) can cause
<code>poi-ooxml</code> to read unexpected data or consume
excessive resources. It affects all <code>poi-ooxml</code>
releases before 5.4.0 (fixed in 5.4.0). Solr bundles
an affected …</p></summary><content type="html"><p>CVE-2025-31672
(CVSS 6.9) is an improper-input-validation issue in Apache POI's OOXML parser:
parsing
@@ -2349,29 +2404,4 @@ in Solr 8.1.0 (2.4.0) and shipped an affected version —
2.4.0, then 2.7.0, the
<p>Please refer to the Upgrade Notes in the Solr Ref Guide for
information on upgrading from previous Solr versions:</p>
<p><a
href="https://solr.apache.org/guide/solr/9_2/upgrade-notes/solr-upgrade-notes.html">https://solr.apache.org/guide/solr/9_2/upgrade-notes/solr-upgrade-notes.html</a></p>
<p>Please read CHANGES.txt for a full list of new features, changes and
bugfixes:</p>
-<p><a
href="https://solr.apache.org/9_2_0/changes/Changes.html">https://solr.apache.org/9_2_0/changes/Changes.html</a></p></content><category
term="solr/news"/></entry><entry><title>Apache Solr™ 9.1.1
available</title><link href="/apache-solrtm-911-available.html"
rel="alternate"/><published>2023-01-25T00:00:00+00:00</published><updated>2023-01-25T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2023-01-25:/apache-solrtm-911-availa
[...]
-<p>Solr is the popular, blazing fast, open source NoSQL search platform
from the Apache Solr project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document handling, and …</p></summary><content
type="html"><p>The Solr PMC is pleased to announce the release of Apache
Solr 9.1.1.</p>
-<p>Solr is the popular, blazing fast, open source NoSQL search platform
from the Apache Solr project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document handling, and geospatial search. Solr is highly
scalable, providing fault tolerant distributed search and indexing, and powers
the search and navigation features of many of the world's largest internet
sites.</p>
-<p>Solr 9.1.1 is available for immediate download at:</p>
-<p><a
href="https://solr.apache.org/downloads.html">https://solr.apache.org/downloads.html</a></p>
-<h3 id="solr-911-release-highlights">Solr 9.1.1 Release Highlights:<a
class="headerlink" href="#solr-911-release-highlights" title="Permanent
link">&para;</a></h3>
-<p>Bugfixes</p>
-<ul>
-<li>SOLR-16589: Fixed issue where large fields with large=true could be
truncated when using unicode values</li>
-<li>SOLR-16585: Fixed NPE when paginating MatchAllDocs with non-zero
start offset, like <code>q=*:*&amp;start=10</code></li>
-<li>SOLR-16165: Fixed rare deadlock in SlotAcc static
initialization</li>
-<li>SOLR-16622: Fixed issue where replicas could fail to register as
active after node restart</li>
-</ul>
-<p>Other</p>
-<ul>
-<li>SOLR-16443: Upgrade Jackson bom to 2.13.4.20221013</li>
-<li>SOLR-16568: Upgrade woodstox-core to 6.4.0</li>
-<li>SOLR-16598: Upgrade Protobuf to 3.21.12</li>
-<li>SOLR-16567: Fixed problem with filtering and KNN search, especially
when using post-filters</li>
-<li>SOLR-16588: Fixed problem with default knn algorithm</li>
-<li>SOLR-16480: ConfigSets now have an overridable allow-list for
filetypes</li>
-</ul>
-<p>Please refer to the Upgrade Notes in the Solr Ref Guide for
information on upgrading from previous Solr versions:</p>
-<p><a
href="https://solr.apache.org/guide/solr/9_1/upgrade-notes/solr-upgrade-notes.html">https://solr.apache.org/guide/solr/9_1/upgrade-notes/solr-upgrade-notes.html</a></p>
-<p>Please read CHANGES.txt for a full list of bugfixes:</p>
-<p><a
href="https://solr.apache.org/9_1_1/changes/Changes.html">https://solr.apache.org/9_1_1/changes/Changes.html</a></p></content><category
term="solr/news"/></entry><entry><title>xercesImpl</title><link
href="/cve-2012-0881.html"
rel="alternate"/><published>2022-12-14T00:00:00+00:00</published><updated>2022-12-14T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2022-12-14:/cve-2012-0881.html</id><content
type="html"><p>Onl [...]
\ No newline at end of file
+<p><a
href="https://solr.apache.org/9_2_0/changes/Changes.html">https://solr.apache.org/9_2_0/changes/Changes.html</a></p></content><category
term="solr/news"/></entry></feed>
\ No newline at end of file
diff --git a/output/feeds/solr/vex.atom.xml b/output/feeds/solr/vex.atom.xml
index 487042eb3..6ba853bd0 100644
--- a/output/feeds/solr/vex.atom.xml
+++ b/output/feeds/solr/vex.atom.xml
@@ -18,7 +18,9 @@ avro &lt; 1.11.3). Both require the application to feed
attacker-controlled
input.</li>
</ul>
<p>The affected range covers the 9.x line, where the optional Hadoop
modules transitively carry Avro
-1.9.2; Solr's own code path never invokes it.</p></content><category
term="solr/vex"/></entry><entry><title>jackson-core: memory disclosure via
source snippet in JsonLocation error messages</title><link
href="/cve-2025-49128.html"
rel="alternate"/><published>2026-07-31T00:00:00+00:00</published><updated>2026-07-31T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-07-31:/cve-2025-49128.html</id><summary
type="html"><p>CVE-2025-49128 can dis [...]
+1.9.2; Solr's own code path never invokes it. A scanner surfaces this as
<code>[email protected]</code> because Avro is
+shaded inside <code>hadoop-client-runtime-3.4.0.jar</code> in the
<code>hdfs</code> module (this is the form reported by
+SOLR-17900); it is the same non-reachable Hadoop transitive either
way.</p></content><category
term="solr/vex"/></entry><entry><title>jackson-core: memory disclosure via
source snippet in JsonLocation error messages</title><link
href="/cve-2025-49128.html"
rel="alternate"/><published>2026-07-31T00:00:00+00:00</published><updated>2026-07-31T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-07-31:/cve-2025-49128.html</id><summary
type="html"><p [...]
includes in <code>JsonLocation</code> (e.g. surfaced in
parse-error messages). It affects jackson-core &lt; 2.13.0.</p>
<p>Solr is <strong>not affected</strong>. Solr's own
jackson-core is 2.18.0 in current 9.x and 2.22.0 in 9.11 — both
…</p></summary><content type="html"><p>CVE-2025-49128 can disclose
adjacent buffer memory through the source snippet that jackson-core
includes in <code>JsonLocation</code> (e.g. surfaced in
parse-error messages). It affects jackson-core &lt; 2.13.0.</p>
@@ -1296,7 +1298,20 @@ in any of the ways these CVEs require:</p>
below the fixed 1.74/1.78. Solr 10.0.0 upgraded the extraction stack to Tika
3.x, whose PDFBox no
longer bundles Bouncy Castle, so 10.x ships no <code>bcprov</code>
at all. The affected range is therefore
7.3.0 – 9.10.1. (Solr 9.5–9.6 also briefly bundled a separate
<code>bcprov-jdk18on</code> 1.77 for another
-module, fixed to 1.78.1 in 9.7; the same not-affected reasoning
applies.)</p></content><category
term="solr/vex"/></entry><entry><title>Apache James MIME4J: header injection
when composing MIME messages</title><link href="/cve-2024-21742.html"
rel="alternate"/><published>2025-09-07T00:00:00+00:00</published><updated>2025-09-07T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2025-09-07:/cve-2024-21742.html</id><summary
type="html"><p>CVE-2024- [...]
+module, fixed to 1.78.1 in 9.7; the same not-affected reasoning
applies.)</p></content><category
term="solr/vex"/></entry><entry><title>Nimbus JOSE + JWT: denial of service
parsing crafted JOSE objects</title><link href="/cve-2023-52428.html"
rel="alternate"/><published>2025-09-07T00:00:00+00:00</published><updated>2025-09-07T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2025-09-07:/cve-2023-52428.html</id><summary
type="html"><p>CVE-2023-5 [...]
+object (for example a PBES2-encrypted JWE with a huge
<code>p2c</code> iteration count, or a large deeply-nested
+structure) can consume excessive resources (fixed in 9.37.2). It is only
reachable when an
+application parses …</p></summary><content
type="html"><p>CVE-2023-52428 (CVSS 8.7) is a denial-of-service issue in
Nimbus JOSE + JWT: parsing a crafted JOSE
+object (for example a PBES2-encrypted JWE with a huge
<code>p2c</code> iteration count, or a large deeply-nested
+structure) can consume excessive resources (fixed in 9.37.2). It is only
reachable when an
+application parses attacker-supplied JOSE/JWT input with Nimbus.</p>
+<p>Solr is <strong>not affected</strong>. Solr's own JWT
authentication (the optional <code>jwt-auth</code> module,
+<code>JWTAuthPlugin</code>) parses tokens with
<strong>jose4j</strong>, not Nimbus (see CVE-2025-53864). The
Nimbus copy a
+scanner flags (<code>[email protected]</code>) is shaded inside
<code>hadoop-client-runtime</code> in the optional
+<code>hdfs</code> module and is only used by Hadoop's own internal
auth machinery — Solr never routes an
+untrusted, externally-supplied JOSE object to it. The vulnerable parser is
therefore not reached. The
+affected range spans the releases whose <code>hdfs</code> module
bundles the affected shaded Nimbus (Solr
+9.0.0 – 9.10.1); Solr 10.x ships no
<code>hadoop-client-runtime</code>.</p></content><category
term="solr/vex"/></entry><entry><title>Apache James MIME4J: header injection
when composing MIME messages</title><link href="/cve-2024-21742.html"
rel="alternate"/><published>2025-09-07T00:00:00+00:00</published><updated>2025-09-07T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2025-09-07:/cve-2024-21742.html</id><summary
type="html"><p> [...]
used to <strong>compose / write</strong> MIME messages, improper
input validation lets crafted field values inject
unintended headers into the produced message. It affects
<code>apache-mime4j</code> before 0.8.10 (fixed in
0.8.10), and is …</p></summary><content
type="html"><p>CVE-2024-21742 (CVSS 5.3) is a header-injection issue in
Apache James MIME4J: when the library is
@@ -1313,7 +1328,47 @@ regardless of whether the (non-default,
not-recommended-for-production) Solr Cel
3.6.0 – 9.10.1, but the composition code path this CVE requires is not
exercised in any of them.
Operators who run Solr Cell can additionally follow the project's guidance to
perform document
extraction in a separate Tika service, or replace
<code>modules/extraction/lib/apache-mime4j-*.jar</code> with
-0.8.10 or later.</p></content><category
term="solr/vex"/></entry><entry><title>Apache POI: improper input validation
parsing OOXML files</title><link href="/cve-2025-31672.html"
rel="alternate"/><published>2025-09-07T00:00:00+00:00</published><updated>2025-09-07T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2025-09-07:/cve-2025-31672.html</id><summary
type="html"><p>CVE-2025-31672 (CVSS 6.9) is an improper-input-validation
issue in Apache P [...]
+0.8.10 or later.</p></content><category
term="solr/vex"/></entry><entry><title>dnsjava: DNSSEC validation
bypass</title><link href="/cve-2024-25638.html"
rel="alternate"/><published>2025-09-07T00:00:00+00:00</published><updated>2025-09-07T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2025-09-07:/cve-2024-25638.html</id><summary
type="html"><p>CVE-2024-25638 (CVSS 7.0) is a DNSSEC-validation bypass
in dnsjava: a resolver relying on dnsjava to
+validate DNSSEC could be tricked into accepting spoofed records (affects
dnsjava &lt; 3.6.0). It matters
+only for an application that uses dnsjava as its resolver and relies on its
DNSSEC validation for a …</p></summary><content
type="html"><p>CVE-2024-25638 (CVSS 7.0) is a DNSSEC-validation bypass in
dnsjava: a resolver relying on dnsjava to
+validate DNSSEC could be tricked into accepting spoofed records (affects
dnsjava &lt; 3.6.0). It matters
+only for an application that uses dnsjava as its resolver and relies on its
DNSSEC validation for a
+security decision.</p>
+<p>Solr is <strong>not affected</strong>. dnsjava is not a
Solr dependency in its own right — it is shaded inside
+<code>hadoop-client-runtime</code> (reported by scanners as
<code>[email protected]</code>) in the optional
<code>hdfs</code> module,
+where Hadoop may use it for name resolution. Solr uses the HDFS module only as
a <strong>client</strong> that
+connects to operator-configured HDFS NameNode/DataNode hosts, not
attacker-controlled names, and it
+does not rely on dnsjava's DNSSEC validation to make any security decision.
The vulnerable resolver
+path is therefore not reached. The affected range spans the releases whose
<code>hdfs</code> module bundles an
+affected shaded dnsjava (Solr 9.0.0 – 9.10.1); Solr 10.x ships no
<code>hadoop-client-runtime</code>.</p></content><category
term="solr/vex"/></entry><entry><title>Apache Commons Compress:
OutOfMemoryError unpacking a broken Pack200 file</title><link
href="/cve-2024-26308.html"
rel="alternate"/><published>2025-09-07T00:00:00+00:00</published><updated>2025-09-07T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2025-09-07:/cve-2024-26308.h [...]
+malformed <strong>Pack200</strong>
(<code>.pack</code>/<code>.pack.gz</code>) stream can
allocate excessive memory and throw
+<code>OutOfMemoryError</code> (affects 1.21 through 1.25.0, fixed
in 1.26.0). It is reachable only when an
+application uses Commons Compress to …</p></summary><content
type="html"><p>CVE-2024-26308 (CVSS 6.7) is a denial-of-service issue in
Apache Commons Compress: unpacking a
+malformed <strong>Pack200</strong>
(<code>.pack</code>/<code>.pack.gz</code>) stream can
allocate excessive memory and throw
+<code>OutOfMemoryError</code> (affects 1.21 through 1.25.0, fixed
in 1.26.0). It is reachable only when an
+application uses Commons Compress to unpack an attacker-supplied Pack200
archive.</p>
+<p>Solr is <strong>not affected</strong>. Solr never unpacks
Pack200 archives — Pack200 (a legacy JAR-compression
+format) is not part of any Solr request path. The affected
<code>commons-compress</code> a scanner flags
+(<code>[email protected]</code>) is the copy shaded into
<code>hadoop-client-runtime</code> in the optional
<code>hdfs</code>
+module; Solr's HDFS-client usage does not feed untrusted Pack200 input to it,
and Solr's own use of
+Commons Compress elsewhere does not invoke the Pack200 unpacker. The
vulnerable code path is therefore
+not reached. The affected range spans the releases whose
<code>hdfs</code> module bundles an affected shaded
+commons-compress (Solr 9.0.0 – 9.10.1); Solr 10.x ships no
<code>hadoop-client-runtime</code>.</p></content><category
term="solr/vex"/></entry><entry><title>Apache Commons Configuration:
StackOverflowError in list-delimiter handling</title><link
href="/cve-2024-29131.html"
rel="alternate"/><published>2025-09-07T00:00:00+00:00</published><updated>2025-09-07T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2025-09-07:/cve-2024-29131.html</ [...]
+Configuration's list-delimiter handling —
<code>AbstractListDelimiterHandler.flattenIterator(...)</code> and
+<code>ListDelimiterHandler.flatten(Object, int)</code>
respectively — when a configuration contains a cyclic
+reference (both affect 2.0 through 2.10.0, fixed in 2.10.1).</p>
+<p>Solr is <strong>not affected</strong>. Solr uses
<code>commons-configuration2</code> only through
…</p></summary><content type="html"><p>CVE-2024-29131 and
CVE-2024-29133 are denial-of-service issues (StackOverflowError) in Apache
Commons
+Configuration's list-delimiter handling —
<code>AbstractListDelimiterHandler.flattenIterator(...)</code> and
+<code>ListDelimiterHandler.flatten(Object, int)</code>
respectively — when a configuration contains a cyclic
+reference (both affect 2.0 through 2.10.0, fixed in 2.10.1).</p>
+<p>Solr is <strong>not affected</strong>. Solr uses
<code>commons-configuration2</code> only through its optional Hadoop
+integration — both the standalone copy in the
<code>hadoop-auth</code> module and the copy shaded into
+<code>hadoop-client-runtime</code> (which a scanner reports as
<code>[email protected]</code>) — to load
+<strong>administrator-supplied</strong> Hadoop configuration
files, never untrusted external input. No Solr request
+path feeds attacker-controlled configuration to Commons Configuration, so the
recursive list-delimiter
+parser cannot be driven by an adversary. This matches the existing assessment
of the other Commons
+Configuration CVEs (CVE-2022-33980, CVE-2026-45205). The affected range spans
the releases whose
+Hadoop modules carry an affected commons-configuration2 (Solr 9.0.0 –
9.10.1).</p></content><category
term="solr/vex"/></entry><entry><title>Apache POI: improper input validation
parsing OOXML files</title><link href="/cve-2025-31672.html"
rel="alternate"/><published>2025-09-07T00:00:00+00:00</published><updated>2025-09-07T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2025-09-07:/cve-2025-31672.html</id><summary
type="html"><p>CVE-2025-3167 [...]
a crafted OOXML file (<code>.xlsx</code>,
<code>.docx</code>, etc.) can cause
<code>poi-ooxml</code> to read unexpected data or consume
excessive resources. It affects all <code>poi-ooxml</code>
releases before 5.4.0 (fixed in 5.4.0). Solr bundles
an affected …</p></summary><content type="html"><p>CVE-2025-31672
(CVSS 6.9) is an improper-input-validation issue in Apache POI's OOXML parser:
parsing
diff --git a/output/security-dependency-cves.html
b/output/security-dependency-cves.html
index 025aa8583..655040865 100644
--- a/output/security-dependency-cves.html
+++ b/output/security-dependency-cves.html
@@ -632,6 +632,33 @@ or contact <a
href="mailto:[email protected]";>[email protected]</a>.</p>
</tr>
<tr>
<td>
+<a href="https://nvd.nist.gov/vuln/detail/CVE-2024-29131";>CVE-2024-29131</a>,
<a href="https://nvd.nist.gov/vuln/detail/CVE-2024-29133";>CVE-2024-29133</a>
</td>
+ <td>9.0.0-9.10.1</td>
+ <td>
+ commons-configuration2-2.8.0.jar </td>
+ <td><span class="cdx-not-affected">not affected</span></td>
+ <td><a href="/vex.html#cve-2024-29131">Apache Commons Configuration:
StackOverflowError in list-delimiter handling</a></td>
+ </tr>
+ <tr>
+ <td>
+<a href="https://nvd.nist.gov/vuln/detail/CVE-2024-26308";>CVE-2024-26308</a>
</td>
+ <td>9.0.0-9.10.1</td>
+ <td>
+ commons-compress-1.24.0.jar </td>
+ <td><span class="cdx-not-affected">not affected</span></td>
+ <td><a href="/vex.html#cve-2024-26308">Apache Commons Compress:
OutOfMemoryError unpacking a broken Pack200 file</a></td>
+ </tr>
+ <tr>
+ <td>
+<a href="https://nvd.nist.gov/vuln/detail/CVE-2024-25638";>CVE-2024-25638</a>
</td>
+ <td>9.0.0-9.10.1</td>
+ <td>
+ dnsjava-3.4.0.jar </td>
+ <td><span class="cdx-not-affected">not affected</span></td>
+ <td><a href="/vex.html#cve-2024-25638">dnsjava: DNSSEC validation
bypass</a></td>
+ </tr>
+ <tr>
+ <td>
<a href="https://nvd.nist.gov/vuln/detail/CVE-2024-21742";>CVE-2024-21742</a>
</td>
<td>3.6.0-9.10.1</td>
<td>
@@ -641,6 +668,15 @@ or contact <a
href="mailto:[email protected]";>[email protected]</a>.</p>
</tr>
<tr>
<td>
+<a href="https://nvd.nist.gov/vuln/detail/CVE-2023-52428";>CVE-2023-52428</a>
</td>
+ <td>9.0.0-9.10.1</td>
+ <td>
+ nimbus-jose-jwt-9.31.jar </td>
+ <td><span class="cdx-not-affected">not affected</span></td>
+ <td><a href="/vex.html#cve-2023-52428">Nimbus JOSE + JWT: denial of
service parsing crafted JOSE objects</a></td>
+ </tr>
+ <tr>
+ <td>
<a href="https://nvd.nist.gov/vuln/detail/CVE-2023-33201";>CVE-2023-33201</a>,
<a href="https://nvd.nist.gov/vuln/detail/CVE-2024-29857";>CVE-2024-29857</a>,
<a href="https://nvd.nist.gov/vuln/detail/CVE-2024-30171";>CVE-2024-30171</a>,
<a href="https://nvd.nist.gov/vuln/detail/CVE-2024-30172";>CVE-2024-30172</a>
</td>
<td>7.3.0-9.10.1</td>
<td>
diff --git a/output/solr.openvex.json b/output/solr.openvex.json
index 7f1099c17..7824993cb 100644
--- a/output/solr.openvex.json
+++ b/output/solr.openvex.json
@@ -1604,6 +1604,21 @@
"impact_statement": "Four vulnerabilities in the Bouncy Castle crypto
provider (`org.bouncycastle:bcprov-jdk15on`),\neach in a distinct crypto
operation:\n\n* **CVE-2023-33201** \u2014 LDAP injection in the X.509
`CertStore` (fixed in 1.74); requires using Bouncy\n Castle's LDAP-backed
`CertStore` for certificate lookups.\n* **CVE-2024-29857** \u2014 importing an
EC certificate with crafted F2m parameters causes CPU exhaustion\n (fixed in
1.78); requires parsing/importing an atta [...]
"status_notes": "Affected Apache Solr versions: 7.3.0-9.10.1."
},
+ {
+ "vulnerability": {
+ "name": "CVE-2023-52428"
+ },
+ "products": [
+ {
+ "@id": "nimbus-jose-jwt-9.31.jar"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2025-09-07T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "CVE-2023-52428 (CVSS 8.7) is a denial-of-service
issue in Nimbus JOSE + JWT: parsing a crafted JOSE\nobject (for example a
PBES2-encrypted JWE with a huge `p2c` iteration count, or a large
deeply-nested\nstructure) can consume excessive resources (fixed in 9.37.2). It
is only reachable when an\napplication parses attacker-supplied JOSE/JWT input
with Nimbus.\n\nSolr is **not affected**. Solr's own JWT authentication (the
optional `jwt-auth` module,\n`JWTAuthPlu [...]
+ "status_notes": "Affected Apache Solr versions: 9.0.0-9.10.1."
+ },
{
"vulnerability": {
"name": "CVE-2024-21742"
@@ -1634,6 +1649,114 @@
"impact_statement": "CVE-2024-21742 (CVSS 5.3) is a header-injection
issue in Apache James MIME4J: when the library is\nused to **compose / write**
MIME messages, improper input validation lets crafted field values
inject\nunintended headers into the produced message. It affects
`apache-mime4j` before 0.8.10 (fixed in\n0.8.10), and is only reachable through
MIME4J's message-**building** API (MIME4J DOM composition).\n\nSolr is **not
affected**. `apache-mime4j-core` is bundled only [...]
"status_notes": "Affected Apache Solr versions: 3.6.0-9.10.1."
},
+ {
+ "vulnerability": {
+ "name": "CVE-2024-25638"
+ },
+ "products": [
+ {
+ "@id": "dnsjava-3.4.0.jar"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2025-09-07T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "CVE-2024-25638 (CVSS 7.0) is a DNSSEC-validation
bypass in dnsjava: a resolver relying on dnsjava to\nvalidate DNSSEC could be
tricked into accepting spoofed records (affects dnsjava < 3.6.0). It
matters\nonly for an application that uses dnsjava as its resolver and relies
on its DNSSEC validation for a\nsecurity decision.\n\nSolr is **not affected**.
dnsjava is not a Solr dependency in its own right \u2014 it is shaded
inside\n`hadoop-client-runtime` (reported [...]
+ "status_notes": "Affected Apache Solr versions: 9.0.0-9.10.1."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2024-26308"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.apache.commons/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.commons/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.commons/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.commons/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.commons/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.commons/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.commons/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2025-09-07T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "CVE-2024-26308 (CVSS 6.7) is a denial-of-service
issue in Apache Commons Compress: unpacking a\nmalformed **Pack200**
(`.pack`/`.pack.gz`) stream can allocate excessive memory and
throw\n`OutOfMemoryError` (affects 1.21 through 1.25.0, fixed in 1.26.0). It is
reachable only when an\napplication uses Commons Compress to unpack an
attacker-supplied Pack200 archive.\n\nSolr is **not affected**. Solr never
unpacks Pack200 archives \u2014 Pack200 (a legacy JAR-compr [...]
+ "status_notes": "Affected Apache Solr versions: 9.0.0-9.10.1."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2024-29131"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.apache.commons/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.commons/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.commons/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.commons/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.commons/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.commons/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2025-09-07T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "CVE-2024-29131 and CVE-2024-29133 are
denial-of-service issues (StackOverflowError) in Apache
Commons\nConfiguration's list-delimiter handling \u2014
`AbstractListDelimiterHandler.flattenIterator(...)`
and\n`ListDelimiterHandler.flatten(Object, int)` respectively \u2014 when a
configuration contains a cyclic\nreference (both affect 2.0 through 2.10.0,
fixed in 2.10.1).\n\nSolr is **not affected**. Solr uses
`commons-configuration2` only through its optional Had [...]
+ "status_notes": "Affected Apache Solr versions: 9.0.0-9.10.1."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2024-29133"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.apache.commons/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.commons/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.commons/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.commons/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.commons/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.apache.commons/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2025-09-07T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "CVE-2024-29131 and CVE-2024-29133 are
denial-of-service issues (StackOverflowError) in Apache
Commons\nConfiguration's list-delimiter handling \u2014
`AbstractListDelimiterHandler.flattenIterator(...)`
and\n`ListDelimiterHandler.flatten(Object, int)` respectively \u2014 when a
configuration contains a cyclic\nreference (both affect 2.0 through 2.10.0,
fixed in 2.10.1).\n\nSolr is **not affected**. Solr uses
`commons-configuration2` only through its optional Had [...]
+ "status_notes": "Affected Apache Solr versions: 9.0.0-9.10.1."
+ },
{
"vulnerability": {
"name": "CVE-2025-31672"
@@ -2848,7 +2971,7 @@
"status": "not_affected",
"timestamp": "2026-07-31T00:00:00Z",
"justification": "vulnerable_code_not_in_execute_path",
- "impact_statement": "CVE-2024-47561 (critical) is an
arbitrary-code-execution issue in the Apache Avro Java SDK: parsing\nan
attacker-controlled Avro **schema** can instantiate arbitrary classes (affects
avro < 1.11.4).\nCVE-2023-39410 is a memory-exhaustion / DoS issue when
**deserializing untrusted Avro data** (affects\navro < 1.11.3). Both require
the application to feed attacker-controlled Avro input to the SDK.\n\nSolr is
**not affected**:\n\n* **Solr does not use Apache Avro. [...]
+ "impact_statement": "CVE-2024-47561 (critical) is an
arbitrary-code-execution issue in the Apache Avro Java SDK: parsing\nan
attacker-controlled Avro **schema** can instantiate arbitrary classes (affects
avro < 1.11.4).\nCVE-2023-39410 is a memory-exhaustion / DoS issue when
**deserializing untrusted Avro data** (affects\navro < 1.11.3). Both require
the application to feed attacker-controlled Avro input to the SDK.\n\nSolr is
**not affected**:\n\n* **Solr does not use Apache Avro. [...]
"status_notes": "Affected Apache Solr versions: 9.0.0-9.10.1."
},
{
@@ -2863,7 +2986,7 @@
"status": "not_affected",
"timestamp": "2026-07-31T00:00:00Z",
"justification": "vulnerable_code_not_in_execute_path",
- "impact_statement": "CVE-2024-47561 (critical) is an
arbitrary-code-execution issue in the Apache Avro Java SDK: parsing\nan
attacker-controlled Avro **schema** can instantiate arbitrary classes (affects
avro < 1.11.4).\nCVE-2023-39410 is a memory-exhaustion / DoS issue when
**deserializing untrusted Avro data** (affects\navro < 1.11.3). Both require
the application to feed attacker-controlled Avro input to the SDK.\n\nSolr is
**not affected**:\n\n* **Solr does not use Apache Avro. [...]
+ "impact_statement": "CVE-2024-47561 (critical) is an
arbitrary-code-execution issue in the Apache Avro Java SDK: parsing\nan
attacker-controlled Avro **schema** can instantiate arbitrary classes (affects
avro < 1.11.4).\nCVE-2023-39410 is a memory-exhaustion / DoS issue when
**deserializing untrusted Avro data** (affects\navro < 1.11.3). Both require
the application to feed attacker-controlled Avro input to the SDK.\n\nSolr is
**not affected**:\n\n* **Solr does not use Apache Avro. [...]
"status_notes": "Affected Apache Solr versions: 9.0.0-9.10.1."
},
{
diff --git a/output/solr.vex.json b/output/solr.vex.json
index eb5c10204..3b376bfce 100644
--- a/output/solr.vex.json
+++ b/output/solr.vex.json
@@ -7,7 +7,7 @@
"name": "solr",
"version": "SNAPSHOT",
"type": "application",
- "bom-ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "bom-ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
},
"vulnerabilities": [
@@ -23,7 +23,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -39,7 +39,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -55,7 +55,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -71,7 +71,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -87,7 +87,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -103,7 +103,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -119,7 +119,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -135,7 +135,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -151,7 +151,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -167,7 +167,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -183,7 +183,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -199,7 +199,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -215,7 +215,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -231,7 +231,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -247,7 +247,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -263,7 +263,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -279,7 +279,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -295,7 +295,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -311,7 +311,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -327,7 +327,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -343,7 +343,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -359,7 +359,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -375,7 +375,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -391,7 +391,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -407,7 +407,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -423,7 +423,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -439,7 +439,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -455,7 +455,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -471,7 +471,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -487,7 +487,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -503,7 +503,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -519,7 +519,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -535,7 +535,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -551,7 +551,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -567,7 +567,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -583,7 +583,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -599,7 +599,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -615,7 +615,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -631,7 +631,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -647,7 +647,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -663,7 +663,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -679,7 +679,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -695,7 +695,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -711,7 +711,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -727,7 +727,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -743,7 +743,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -759,7 +759,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -775,7 +775,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -791,7 +791,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -807,7 +807,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -823,7 +823,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -839,7 +839,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -855,7 +855,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -871,7 +871,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -887,7 +887,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -903,7 +903,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -919,7 +919,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -935,7 +935,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -951,7 +951,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -970,7 +970,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -986,7 +986,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1002,7 +1002,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1018,7 +1018,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1037,7 +1037,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1053,7 +1053,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1070,7 +1070,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1087,7 +1087,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1104,7 +1104,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1121,7 +1121,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1138,7 +1138,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1155,7 +1155,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1172,7 +1172,24 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
+ }
+ ]
+ },
+ {
+ "id": "CVE-2023-52428",
+ "source": {
+ "name": "NVD",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52428";
+ },
+ "analysis": {
+ "state": "not_affected",
+ "justification": "code_not_reachable",
+ "detail": "CVE-2023-52428 (CVSS 8.7) is a denial-of-service issue in
Nimbus JOSE + JWT: parsing a crafted JOSE\nobject (for example a
PBES2-encrypted JWE with a huge `p2c` iteration count, or a large
deeply-nested\nstructure) can consume excessive resources (fixed in 9.37.2). It
is only reachable when an\napplication parses attacker-supplied JOSE/JWT input
with Nimbus.\n\nSolr is **not affected**. Solr's own JWT authentication (the
optional `jwt-auth` module,\n`JWTAuthPlugin`) pa [...]
+ },
+ "affects": [
+ {
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1189,7 +1206,75 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
+ }
+ ]
+ },
+ {
+ "id": "CVE-2024-25638",
+ "source": {
+ "name": "NVD",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25638";
+ },
+ "analysis": {
+ "state": "not_affected",
+ "justification": "code_not_reachable",
+ "detail": "CVE-2024-25638 (CVSS 7.0) is a DNSSEC-validation bypass in
dnsjava: a resolver relying on dnsjava to\nvalidate DNSSEC could be tricked
into accepting spoofed records (affects dnsjava < 3.6.0). It matters\nonly for
an application that uses dnsjava as its resolver and relies on its DNSSEC
validation for a\nsecurity decision.\n\nSolr is **not affected**. dnsjava is
not a Solr dependency in its own right \u2014 it is shaded
inside\n`hadoop-client-runtime` (reported by scan [...]
+ },
+ "affects": [
+ {
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
+ }
+ ]
+ },
+ {
+ "id": "CVE-2024-26308",
+ "source": {
+ "name": "NVD",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26308";
+ },
+ "analysis": {
+ "state": "not_affected",
+ "justification": "code_not_reachable",
+ "detail": "CVE-2024-26308 (CVSS 6.7) is a denial-of-service issue in
Apache Commons Compress: unpacking a\nmalformed **Pack200**
(`.pack`/`.pack.gz`) stream can allocate excessive memory and
throw\n`OutOfMemoryError` (affects 1.21 through 1.25.0, fixed in 1.26.0). It is
reachable only when an\napplication uses Commons Compress to unpack an
attacker-supplied Pack200 archive.\n\nSolr is **not affected**. Solr never
unpacks Pack200 archives \u2014 Pack200 (a legacy JAR-compression\n [...]
+ },
+ "affects": [
+ {
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
+ }
+ ]
+ },
+ {
+ "id": "CVE-2024-29131",
+ "source": {
+ "name": "NVD",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29131";
+ },
+ "analysis": {
+ "state": "not_affected",
+ "justification": "code_not_reachable",
+ "detail": "CVE-2024-29131 and CVE-2024-29133 are denial-of-service
issues (StackOverflowError) in Apache Commons\nConfiguration's list-delimiter
handling \u2014 `AbstractListDelimiterHandler.flattenIterator(...)`
and\n`ListDelimiterHandler.flatten(Object, int)` respectively \u2014 when a
configuration contains a cyclic\nreference (both affect 2.0 through 2.10.0,
fixed in 2.10.1).\n\nSolr is **not affected**. Solr uses
`commons-configuration2` only through its optional Hadoop\nint [...]
+ },
+ "affects": [
+ {
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
+ }
+ ]
+ },
+ {
+ "id": "CVE-2024-29133",
+ "source": {
+ "name": "NVD",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29133";
+ },
+ "analysis": {
+ "state": "not_affected",
+ "justification": "code_not_reachable",
+ "detail": "CVE-2024-29131 and CVE-2024-29133 are denial-of-service
issues (StackOverflowError) in Apache Commons\nConfiguration's list-delimiter
handling \u2014 `AbstractListDelimiterHandler.flattenIterator(...)`
and\n`ListDelimiterHandler.flatten(Object, int)` respectively \u2014 when a
configuration contains a cyclic\nreference (both affect 2.0 through 2.10.0,
fixed in 2.10.1).\n\nSolr is **not affected**. Solr uses
`commons-configuration2` only through its optional Hadoop\nint [...]
+ },
+ "affects": [
+ {
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1206,7 +1291,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1223,7 +1308,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1240,7 +1325,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1257,7 +1342,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1274,7 +1359,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1291,7 +1376,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1311,7 +1396,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1331,7 +1416,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1351,7 +1436,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1368,7 +1453,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1388,7 +1473,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1405,7 +1490,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1422,7 +1507,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1439,7 +1524,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1456,7 +1541,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1473,7 +1558,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1490,7 +1575,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1507,7 +1592,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1524,7 +1609,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1541,7 +1626,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1558,7 +1643,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1575,7 +1660,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1592,7 +1677,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1609,7 +1694,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1626,7 +1711,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1643,7 +1728,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1660,7 +1745,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1677,7 +1762,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1694,7 +1779,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1711,7 +1796,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1728,7 +1813,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1745,7 +1830,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1762,7 +1847,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1779,7 +1864,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1792,11 +1877,11 @@
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
- "detail": "CVE-2024-47561 (critical) is an arbitrary-code-execution
issue in the Apache Avro Java SDK: parsing\nan attacker-controlled Avro
**schema** can instantiate arbitrary classes (affects avro <
1.11.4).\nCVE-2023-39410 is a memory-exhaustion / DoS issue when
**deserializing untrusted Avro data** (affects\navro < 1.11.3). Both require
the application to feed attacker-controlled Avro input to the SDK.\n\nSolr is
**not affected**:\n\n* **Solr does not use Apache Avro.** There [...]
+ "detail": "CVE-2024-47561 (critical) is an arbitrary-code-execution
issue in the Apache Avro Java SDK: parsing\nan attacker-controlled Avro
**schema** can instantiate arbitrary classes (affects avro <
1.11.4).\nCVE-2023-39410 is a memory-exhaustion / DoS issue when
**deserializing untrusted Avro data** (affects\navro < 1.11.3). Both require
the application to feed attacker-controlled Avro input to the SDK.\n\nSolr is
**not affected**:\n\n* **Solr does not use Apache Avro.** There [...]
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1809,11 +1894,11 @@
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
- "detail": "CVE-2024-47561 (critical) is an arbitrary-code-execution
issue in the Apache Avro Java SDK: parsing\nan attacker-controlled Avro
**schema** can instantiate arbitrary classes (affects avro <
1.11.4).\nCVE-2023-39410 is a memory-exhaustion / DoS issue when
**deserializing untrusted Avro data** (affects\navro < 1.11.3). Both require
the application to feed attacker-controlled Avro input to the SDK.\n\nSolr is
**not affected**:\n\n* **Solr does not use Apache Avro.** There [...]
+ "detail": "CVE-2024-47561 (critical) is an arbitrary-code-execution
issue in the Apache Avro Java SDK: parsing\nan attacker-controlled Avro
**schema** can instantiate arbitrary classes (affects avro <
1.11.4).\nCVE-2023-39410 is a memory-exhaustion / DoS issue when
**deserializing untrusted Avro data** (affects\navro < 1.11.3). Both require
the application to feed attacker-controlled Avro input to the SDK.\n\nSolr is
**not affected**:\n\n* **Solr does not use Apache Avro.** There [...]
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1830,7 +1915,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1847,7 +1932,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1864,7 +1949,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1881,7 +1966,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1898,7 +1983,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1915,7 +2000,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1932,7 +2017,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1949,7 +2034,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1966,7 +2051,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -1983,7 +2068,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -2000,7 +2085,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -2017,7 +2102,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -2034,7 +2119,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -2051,7 +2136,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -2068,7 +2153,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -2085,7 +2170,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -2102,7 +2187,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -2119,7 +2204,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -2136,7 +2221,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -2153,7 +2238,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -2170,7 +2255,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -2187,7 +2272,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -2204,7 +2289,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -2221,7 +2306,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -2238,7 +2323,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -2255,7 +2340,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -2272,7 +2357,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -2289,7 +2374,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -2306,7 +2391,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -2323,7 +2408,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -2340,7 +2425,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
},
@@ -2357,7 +2442,7 @@
},
"affects": [
{
- "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ "ref": "898a163f-dc2c-5144-8163-289c017c5a85"
}
]
}
diff --git a/output/vex.html b/output/vex.html
index 3da5baf4c..7fb0698ab 100644
--- a/output/vex.html
+++ b/output/vex.html
@@ -635,6 +635,10 @@ rather than untrusted external JSON, and whose parse
errors are not returned to
<header class="post-header">
<h3 class="title"><a
href="https://nvd.nist.gov/vuln/detail/CVE-2024-47561";>CVE-2024-47561</a>, <a
href="https://nvd.nist.gov/vuln/detail/CVE-2023-39410";>CVE-2023-39410</a>,
Apache Avro (Java): RCE reading a crafted schema / DoS deserializing untrusted
data</h3>
<div class="panel callout">
+ <p class="subheader">
+ <strong>Published:</strong>
+ <time
datetime="2026-07-31T00:00:00+00:00">2026-07-31</time>
+ </p>
<p class="subheader">
<strong>Status:</strong>
<span class="cdx-not-affected">not_affected</span>
@@ -660,10 +664,13 @@ avro < 1.11.3). Both require the application to feed
attacker-controlled Avro
input.</li>
</ul>
<p>The affected range covers the 9.x line, where the optional Hadoop modules
transitively carry Avro
-1.9.2; Solr's own code path never invokes it.</p>
+1.9.2; Solr's own code path never invokes it. A scanner surfaces this as
<code>[email protected]</code> because Avro is
+shaded inside <code>hadoop-client-runtime-3.4.0.jar</code> in the
<code>hdfs</code> module (this is the form reported by
+SOLR-17900); it is the same non-reachable Hadoop transitive either way.</p>
<h4>References</h4>
<ul>
+ <li>JIRA: <a
href="https://issues.apache.org/jira/browse/SOLR-17900";>SOLR-17900</a></li>
<li>CVE: <a
href="https://nvd.nist.gov/vuln/detail/CVE-2024-47561";>CVE-2024-47561</a>, <a
href="https://nvd.nist.gov/vuln/detail/CVE-2023-39410";>CVE-2023-39410</a></li>
</ul>
</article>
@@ -2284,6 +2291,112 @@ extraction out of Solr (the recommended architecture)
or replace the bundled
<li>CVE: <a
href="https://nvd.nist.gov/vuln/detail/CVE-2025-31672";>CVE-2025-31672</a></li>
</ul>
</article>
+ <article id="cve-2024-29131" class="post panel radius">
+ <header class="post-header">
+ <h3 class="title"><a
href="https://nvd.nist.gov/vuln/detail/CVE-2024-29131";>CVE-2024-29131</a>, <a
href="https://nvd.nist.gov/vuln/detail/CVE-2024-29133";>CVE-2024-29133</a>,
Apache Commons Configuration: StackOverflowError in list-delimiter handling</h3>
+ <div class="panel callout">
+ <p class="subheader">
+ <strong>Published:</strong>
+ <time
datetime="2025-09-07T00:00:00+00:00">2025-09-07</time>
+ </p>
+ <p class="subheader">
+ <strong>Status:</strong>
+ <span class="cdx-not-affected">not_affected</span>
+ </p>
+ <p class="subheader"><strong>Affected Solr
versions:</strong> 9.0.0-9.10.1</p>
+ </div>
+ </header>
+
+ <h4>Description</h4>
+ <p>CVE-2024-29131 and CVE-2024-29133 are denial-of-service
issues (StackOverflowError) in Apache Commons
+Configuration's list-delimiter handling —
<code>AbstractListDelimiterHandler.flattenIterator(...)</code> and
+<code>ListDelimiterHandler.flatten(Object, int)</code> respectively — when a
configuration contains a cyclic
+reference (both affect 2.0 through 2.10.0, fixed in 2.10.1).</p>
+<p>Solr is <strong>not affected</strong>. Solr uses
<code>commons-configuration2</code> only through its optional Hadoop
+integration — both the standalone copy in the <code>hadoop-auth</code> module
and the copy shaded into
+<code>hadoop-client-runtime</code> (which a scanner reports as
<code>[email protected]</code>) — to load
+<strong>administrator-supplied</strong> Hadoop configuration files, never
untrusted external input. No Solr request
+path feeds attacker-controlled configuration to Commons Configuration, so the
recursive list-delimiter
+parser cannot be driven by an adversary. This matches the existing assessment
of the other Commons
+Configuration CVEs (CVE-2022-33980, CVE-2026-45205). The affected range spans
the releases whose
+Hadoop modules carry an affected commons-configuration2 (Solr 9.0.0 –
9.10.1).</p>
+
+ <h4>References</h4>
+ <ul>
+ <li>JIRA: <a
href="https://issues.apache.org/jira/browse/SOLR-17900";>SOLR-17900</a></li>
+ <li>CVE: <a
href="https://nvd.nist.gov/vuln/detail/CVE-2024-29131";>CVE-2024-29131</a>, <a
href="https://nvd.nist.gov/vuln/detail/CVE-2024-29133";>CVE-2024-29133</a></li>
+ </ul>
+ </article>
+ <article id="cve-2024-26308" class="post panel radius">
+ <header class="post-header">
+ <h3 class="title"><a
href="https://nvd.nist.gov/vuln/detail/CVE-2024-26308";>CVE-2024-26308</a>,
Apache Commons Compress: OutOfMemoryError unpacking a broken Pack200 file</h3>
+ <div class="panel callout">
+ <p class="subheader">
+ <strong>Published:</strong>
+ <time
datetime="2025-09-07T00:00:00+00:00">2025-09-07</time>
+ </p>
+ <p class="subheader">
+ <strong>Status:</strong>
+ <span class="cdx-not-affected">not_affected</span>
+ </p>
+ <p class="subheader"><strong>Affected Solr
versions:</strong> 9.0.0-9.10.1</p>
+ </div>
+ </header>
+
+ <h4>Description</h4>
+ <p>CVE-2024-26308 (CVSS 6.7) is a denial-of-service issue in
Apache Commons Compress: unpacking a
+malformed <strong>Pack200</strong> (<code>.pack</code>/<code>.pack.gz</code>)
stream can allocate excessive memory and throw
+<code>OutOfMemoryError</code> (affects 1.21 through 1.25.0, fixed in 1.26.0).
It is reachable only when an
+application uses Commons Compress to unpack an attacker-supplied Pack200
archive.</p>
+<p>Solr is <strong>not affected</strong>. Solr never unpacks Pack200 archives
— Pack200 (a legacy JAR-compression
+format) is not part of any Solr request path. The affected
<code>commons-compress</code> a scanner flags
+(<code>[email protected]</code>) is the copy shaded into
<code>hadoop-client-runtime</code> in the optional <code>hdfs</code>
+module; Solr's HDFS-client usage does not feed untrusted Pack200 input to it,
and Solr's own use of
+Commons Compress elsewhere does not invoke the Pack200 unpacker. The
vulnerable code path is therefore
+not reached. The affected range spans the releases whose <code>hdfs</code>
module bundles an affected shaded
+commons-compress (Solr 9.0.0 – 9.10.1); Solr 10.x ships no
<code>hadoop-client-runtime</code>.</p>
+
+ <h4>References</h4>
+ <ul>
+ <li>JIRA: <a
href="https://issues.apache.org/jira/browse/SOLR-17900";>SOLR-17900</a></li>
+ <li>CVE: <a
href="https://nvd.nist.gov/vuln/detail/CVE-2024-26308";>CVE-2024-26308</a></li>
+ </ul>
+ </article>
+ <article id="cve-2024-25638" class="post panel radius">
+ <header class="post-header">
+ <h3 class="title"><a
href="https://nvd.nist.gov/vuln/detail/CVE-2024-25638";>CVE-2024-25638</a>,
dnsjava: DNSSEC validation bypass</h3>
+ <div class="panel callout">
+ <p class="subheader">
+ <strong>Published:</strong>
+ <time
datetime="2025-09-07T00:00:00+00:00">2025-09-07</time>
+ </p>
+ <p class="subheader">
+ <strong>Status:</strong>
+ <span class="cdx-not-affected">not_affected</span>
+ </p>
+ <p class="subheader"><strong>Affected Solr
versions:</strong> 9.0.0-9.10.1</p>
+ </div>
+ </header>
+
+ <h4>Description</h4>
+ <p>CVE-2024-25638 (CVSS 7.0) is a DNSSEC-validation bypass in
dnsjava: a resolver relying on dnsjava to
+validate DNSSEC could be tricked into accepting spoofed records (affects
dnsjava < 3.6.0). It matters
+only for an application that uses dnsjava as its resolver and relies on its
DNSSEC validation for a
+security decision.</p>
+<p>Solr is <strong>not affected</strong>. dnsjava is not a Solr dependency in
its own right — it is shaded inside
+<code>hadoop-client-runtime</code> (reported by scanners as
<code>[email protected]</code>) in the optional <code>hdfs</code> module,
+where Hadoop may use it for name resolution. Solr uses the HDFS module only as
a <strong>client</strong> that
+connects to operator-configured HDFS NameNode/DataNode hosts, not
attacker-controlled names, and it
+does not rely on dnsjava's DNSSEC validation to make any security decision.
The vulnerable resolver
+path is therefore not reached. The affected range spans the releases whose
<code>hdfs</code> module bundles an
+affected shaded dnsjava (Solr 9.0.0 – 9.10.1); Solr 10.x ships no
<code>hadoop-client-runtime</code>.</p>
+
+ <h4>References</h4>
+ <ul>
+ <li>JIRA: <a
href="https://issues.apache.org/jira/browse/SOLR-17900";>SOLR-17900</a></li>
+ <li>CVE: <a
href="https://nvd.nist.gov/vuln/detail/CVE-2024-25638";>CVE-2024-25638</a></li>
+ </ul>
+ </article>
<article id="cve-2024-21742" class="post panel radius">
<header class="post-header">
<h3 class="title"><a
href="https://nvd.nist.gov/vuln/detail/CVE-2024-21742";>CVE-2024-21742</a>,
Apache James MIME4J: header injection when composing MIME messages</h3>
@@ -2323,6 +2436,41 @@ extraction in a separate Tika service, or replace
<code>modules/extraction/lib/a
<li>CVE: <a
href="https://nvd.nist.gov/vuln/detail/CVE-2024-21742";>CVE-2024-21742</a></li>
</ul>
</article>
+ <article id="cve-2023-52428" class="post panel radius">
+ <header class="post-header">
+ <h3 class="title"><a
href="https://nvd.nist.gov/vuln/detail/CVE-2023-52428";>CVE-2023-52428</a>,
Nimbus JOSE + JWT: denial of service parsing crafted JOSE objects</h3>
+ <div class="panel callout">
+ <p class="subheader">
+ <strong>Published:</strong>
+ <time
datetime="2025-09-07T00:00:00+00:00">2025-09-07</time>
+ </p>
+ <p class="subheader">
+ <strong>Status:</strong>
+ <span class="cdx-not-affected">not_affected</span>
+ </p>
+ <p class="subheader"><strong>Affected Solr
versions:</strong> 9.0.0-9.10.1</p>
+ </div>
+ </header>
+
+ <h4>Description</h4>
+ <p>CVE-2023-52428 (CVSS 8.7) is a denial-of-service issue in
Nimbus JOSE + JWT: parsing a crafted JOSE
+object (for example a PBES2-encrypted JWE with a huge <code>p2c</code>
iteration count, or a large deeply-nested
+structure) can consume excessive resources (fixed in 9.37.2). It is only
reachable when an
+application parses attacker-supplied JOSE/JWT input with Nimbus.</p>
+<p>Solr is <strong>not affected</strong>. Solr's own JWT authentication (the
optional <code>jwt-auth</code> module,
+<code>JWTAuthPlugin</code>) parses tokens with <strong>jose4j</strong>, not
Nimbus (see CVE-2025-53864). The Nimbus copy a
+scanner flags (<code>[email protected]</code>) is shaded inside
<code>hadoop-client-runtime</code> in the optional
+<code>hdfs</code> module and is only used by Hadoop's own internal auth
machinery — Solr never routes an
+untrusted, externally-supplied JOSE object to it. The vulnerable parser is
therefore not reached. The
+affected range spans the releases whose <code>hdfs</code> module bundles the
affected shaded Nimbus (Solr
+9.0.0 – 9.10.1); Solr 10.x ships no <code>hadoop-client-runtime</code>.</p>
+
+ <h4>References</h4>
+ <ul>
+ <li>JIRA: <a
href="https://issues.apache.org/jira/browse/SOLR-17900";>SOLR-17900</a></li>
+ <li>CVE: <a
href="https://nvd.nist.gov/vuln/detail/CVE-2023-52428";>CVE-2023-52428</a></li>
+ </ul>
+ </article>
<article id="cve-2023-33201" class="post panel radius">
<header class="post-header">
<h3 class="title"><a
href="https://nvd.nist.gov/vuln/detail/CVE-2023-33201";>CVE-2023-33201</a>, <a
href="https://nvd.nist.gov/vuln/detail/CVE-2024-29857";>CVE-2024-29857</a>, <a
href="https://nvd.nist.gov/vuln/detail/CVE-2024-30171";>CVE-2024-30171</a>, <a
href="https://nvd.nist.gov/vuln/detail/CVE-2024-30172";>CVE-2024-30172</a>,
Bouncy Castle (bcprov): LDAP CertStore injection, EC/Ed25519 DoS, and RSA/TLS
timing side-channel</h3>
