This is an automated email from the ASF dual-hosted git repository.
github-actions[bot] pushed a commit to branch asf-staging
in repository https://gitbox.apache.org/repos/asf/solr-site.git
The following commit(s) were added to refs/heads/asf-staging by this push:
new 0da1547a5 Commit build products
0da1547a5 is described below
commit 0da1547a57d5baccd5782de654ebdf52660d30fd
Author: Build Pelican (action) <[email protected]>
AuthorDate: Thu Aug 13 14:43:36 2026 +0000
Commit build products
---
output/feeds/all.atom.xml | 125 ++++++------
output/feeds/solr/vex.atom.xml | 108 +++++++----
output/security-dependency-cves.html | 22 ++-
output/solr.openvex.json | 80 ++++----
output/solr.vex.json | 365 ++++++++++++++++++-----------------
output/vex.html | 134 ++++++++++---
6 files changed, 508 insertions(+), 326 deletions(-)
diff --git a/output/feeds/all.atom.xml b/output/feeds/all.atom.xml
index 85f4dc42e..3f087c540 100644
--- a/output/feeds/all.atom.xml
+++ b/output/feeds/all.atom.xml
@@ -1,5 +1,52 @@
<?xml version="1.0" encoding="utf-8"?>
-<feed xmlns="http://www.w3.org/2005/Atom";><title>Apache Solr</title><link
href="/" rel="alternate"/><link href="/feeds/all.atom.xml"
rel="self"/><id>/</id><updated>2026-07-31T00:00:00+00:00</updated><entry><title>Apache
Avro (Java): RCE reading a crafted schema / DoS deserializing untrusted
data</title><link href="/cve-2024-47561.html"
rel="alternate"/><published>2026-07-31T00:00:00+00:00</published><updated>2026-07-31T00:00:00+00:00</updated><author><name>Solr
Developers</name></author> [...]
+<feed xmlns="http://www.w3.org/2005/Atom";><title>Apache Solr</title><link
href="/" rel="alternate"/><link href="/feeds/all.atom.xml"
rel="self"/><id>/</id><updated>2026-08-13T00:00:00+00:00</updated><entry><title>lz4-java:
out-of-bounds memory access and insufficient buffer clearing in
compression/decompression</title><link href="/cve-2025-12183.html"
rel="alternate"/><published>2026-08-13T00:00:00+00:00</published><updated>2026-08-13T00:00:00+00:00</updated><author><name>Solr
Developers [...]
+<ul>
+<li><strong>CVE-2025-12183</strong> — several lz4-java
compression/decompression implementations do not guard against
+ out-of-bounds memory access (fixed in <code>lz4-java</code>
1.8.1).</li>
+<li><strong>CVE-2025-66566</strong> — decompressor
implementations insufficiently clear their buffers, allowing a
+ caller to read leftover contents of a previously used buffer (fixed in
<code>lz4-java</code> 1.10.1
…</li></ul></summary><content type="html"><p>Two issues in
the <code>lz4-java</code> codec:</p>
+<ul>
+<li><strong>CVE-2025-12183</strong> — several lz4-java
compression/decompression implementations do not guard against
+ out-of-bounds memory access (fixed in <code>lz4-java</code>
1.8.1).</li>
+<li><strong>CVE-2025-66566</strong> — decompressor
implementations insufficiently clear their buffers, allowing a
+ caller to read leftover contents of a previously used buffer (fixed in
<code>lz4-java</code> 1.10.1).</li>
+</ul>
+<p>Both require an application to drive lz4-java's (de)compression APIs
with attacker-influenced
+input/buffers.</p>
+<p>Solr is <strong>not affected</strong>.
<code>lz4-java</code> is bundled only by the optional
<code>cross-dc</code> module, where it is
+used by the embedded Apache Kafka client for LZ4 compression of
cross-datacenter replication messages.
+Kafka manages its own internal, validated buffers and does not forward
attacker-controlled data into
+the vulnerable code paths, and the replication stream flows through an
operator-controlled Kafka
+pipeline rather than untrusted external input. The
<code>cross-dc</code> module is not part of a default Solr
+installation, and no Solr request path reaches these lz4-java
routines.</p>
+<p>Solr shipped an affected <code>org.lz4:lz4-java</code>
1.8.0 from 9.8.0 (when the <code>cross-dc</code> module first
bundled
+it) through 10.0.0; releases 9.7.0 and earlier, and the 8.x line, ship no
<code>lz4-java</code>. The fix is
+already on all active development branches:
<code>branch_9x</code>, <code>branch_10x</code>, and
<code>main</code> migrated to the
+maintained community fork <code>at.yawk.lz4:lz4-java</code>
1.10.1, which is past both fixes (1.8.1 and 1.10.1),
+so the next releases (9.11, 10.1) will not be affected. Note this upgrade did
not require Apache Kafka
+to update first — Kafka still declares the old
<code>org.lz4:lz4-java</code>, and Solr replaced that transitive
+dependency with the fork directly.</p></content><category
term="solr/vex"/></entry><entry><title>Woodstox: denial-of-service (stack
overflow) parsing untrusted XML when DTD support is enabled</title><link
href="/cve-2022-40152.html"
rel="alternate"/><published>2026-08-11T00:00:00+00:00</published><updated>2026-08-11T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-08-11:/cve-2022-40152.html</id><summary
type="html"><p>CVE-2022-40152 (CVSS [...]
+(<code>com.fasterxml.woodstox:woodstox-core</code>): when DTD
support is enabled, a client can supply XML whose
+<code>DOCTYPE</code> internal subset contains a deeply-nested
element content model, causing the parser to
+recurse until it throws a <code>StackOverflowError</code>. It
affects <code>woodstox-core …</code></p></summary><content
type="html"><p>CVE-2022-40152 (CVSS 6.5) is a denial-of-service issue in
the Woodstox XML parser
+(<code>com.fasterxml.woodstox:woodstox-core</code>): when DTD
support is enabled, a client can supply XML whose
+<code>DOCTYPE</code> internal subset contains a deeply-nested
element content model, causing the parser to
+recurse until it throws a <code>StackOverflowError</code>. It
affects <code>woodstox-core</code> before 5.4.0 and 6.0.0 –
+6.3.x, and is fixed in 5.4.0 and 6.4.0.</p>
+<p>Solr <strong>9.0.0 and 9.1.0 are affected.</strong> Those
two releases shipped <code>woodstox-core</code> 6.2.8 (&lt;
6.4.0), and
+Solr's XML update handler (<code>XMLLoader</code>, serving the
untrusted <code>/update</code> request path) configures its
+StAX input factory via
<code>EmptyEntityResolver.configureXMLInputFactory</code>. That
configuration neutralizes
+external entities — so Solr is <em>not</em> exposed to XXE — but
it does <strong>not</strong> disable DTD processing, so
+the parser still reads the internal DTD subset. A client that POSTs crafted
XML with a deeply-nested
+DTD to <code>/update</code> can therefore reach the vulnerable
code and trigger the stack-overflow DoS. Because
+the vulnerable path is reachable with attacker-controlled input, these
releases are marked
+<code>exploitable</code> rather than
<code>not_affected</code>.</p>
+<p><strong>Remediation: upgrade to Apache Solr 9.1.1 or
later.</strong> Solr 9.1.1 upgraded to
<code>woodstox-core</code> 6.4.0
+(past the fix), and every later release ships a fixed version (6.5.0 in 9.2.0,
7.0.0 in current 9.x,
+7.1.1 in 10.0.0), so no release from 9.1.1 onward is affected. Solr 8.x and
earlier are out of scope
+for this CVE: they used the unrelated
<code>org.codehaus.woodstox:woodstox-core-asl</code> artifact, not
+<code>com.fasterxml.woodstox:woodstox-core</code> (the migration
in SOLR-10702 introduced the affected artifact
+at 9.0.0). Solr 9.0.0 and 9.1.0 are both end of
life.</p></content><category
term="solr/vex"/></entry><entry><title>Apache Avro (Java): RCE reading a
crafted schema / DoS deserializing untrusted data</title><link
href="/cve-2024-47561.html"
rel="alternate"/><published>2026-07-31T00:00:00+00:00</published><updated>2026-07-31T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-07-31:/cve-2024-47561.html</id><summary
type="html"><p>CVE-2024-475 [...]
an attacker-controlled Avro <strong>schema</strong> can
instantiate arbitrary classes (affects avro &lt; 1.11.4).
CVE-2023-39410 is a memory-exhaustion / DoS issue when
<strong>deserializing untrusted Avro data</strong> (affects
avro &lt; 1.11.3). Both require the application to feed
attacker-controlled Avro …</p></summary><content
type="html"><p>CVE-2024-47561 (critical) is an arbitrary-code-execution
issue in the Apache Avro Java SDK: parsing
@@ -257,34 +304,27 @@ Netty &lt; 4.1.136 and 4.2.0–4.2.15, fixed in 4.1.136
/ 4.2.16):</p>
<p>Solr is <strong>not affected</strong>. Solr bundles Netty
only via the optional OpenTelemetry (OTLP) exporter and
the ZooKeeper client, where Netty is used strictly as a
<strong>client</strong>. Solr's HTTP server is Jetty:
Solr never runs a Netty HTTP server, CORS handler, WebSocket server, or
HTTP/2→1 proxy, and never
-uses Netty's multipart request encoder, so none of these code paths are
reachable.</p></content><category
term="solr/vex"/></entry><entry><title>lz4-java: out-of-bounds access and
buffer-reuse disclosure in (de)compression</title><link
href="/cve-2026-59949.html"
rel="alternate"/><published>2026-07-31T00:00:00+00:00</published><updated>2026-07-31T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-07-31:/cve-2026-59949.html</id><summary
type="html [...]
-lz4-java):</p>
-<ul>
-<li><strong>CVE-2026-59949</strong> (CVSS 6.5) —
out-of-bounds read: the JNI-based XXHash implementations don't
- validate their byte-array arguments, so a caller passing an invalid array
reference or out-of-range
- <code>off</code>/<code>len</code> can crash the JVM
(fixed in 1 …</li></ul></summary><content
type="html"><p>Three issues in the
<code>at.yawk.lz4:lz4-java</code> codec (the community-maintained
fork of the discontinued
-lz4-java):</p>
-<ul>
-<li><strong>CVE-2026-59949</strong> (CVSS 6.5) —
out-of-bounds read: the JNI-based XXHash implementations don't
- validate their byte-array arguments, so a caller passing an invalid array
reference or out-of-range
- <code>off</code>/<code>len</code> can crash the JVM
(fixed in 1.11.1).</li>
-<li><strong>CVE-2025-12183</strong> — out-of-bounds memory
access in the compression/decompression functions,
- leading to denial of service and possible information disclosure when
processing untrusted input
- (fixed in 1.8.1).</li>
-<li><strong>CVE-2025-66566</strong> — the Java decompressor
does not clear reused output buffers, so crafted
- compressed input can read previous buffer contents when an output buffer is
reused (fixed in
- 1.10.1).</li>
-</ul>
-<p>All three affect the <code>lz4-java</code> 1.8.0 that
Solr's released 9.8.0 – 10.0.0 line bundles (SOLR-18013
-tracks the upgrade to 1.10.1). Each is reachable only when an application
feeds attacker-controlled
-input to the codec, or passes attacker-influenced arguments into it.</p>
-<p>Solr is <strong>not affected</strong>.
<code>lz4-java</code> is bundled only by the optional
<code>cross-dc</code> module, where the
-embedded Apache Kafka client uses it to (de)compress and checksum
cross-datacenter replication
-messages. Those messages flow through an
<strong>operator-controlled</strong> Kafka pipeline (Solr's own
cross-DC
-producer → the operator's Kafka → Solr's consumer), not untrusted external
input, and Kafka calls the
-codec with its own internally-managed, validated buffers and offsets rather
than forwarding
-attacker-controlled arguments. The <code>cross-dc</code> module is
not part of a default Solr installation, and
-no Solr request path reaches the vulnerable compression/decompression or
XXHash code.</p></content><category
term="solr/vex"/></entry><entry><title>Eclipse Jetty: HTTP/2 :authority vs Host
header confusion</title><link href="/cve-2026-6790.html"
rel="alternate"/><published>2026-07-31T00:00:00+00:00</published><updated>2026-07-31T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-07-31:/cve-2026-6790.html</id><summary
type="html"><p>CVE-2026 [...]
+uses Netty's multipart request encoder, so none of these code paths are
reachable.</p></content><category
term="solr/vex"/></entry><entry><title>lz4-java: out-of-bounds read via invalid
arguments to native XXHash</title><link href="/cve-2026-59949.html"
rel="alternate"/><published>2026-07-31T00:00:00+00:00</published><updated>2026-07-31T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-07-31:/cve-2026-59949.html</id><summary
type="html"><p> [...]
+implementations insufficiently validate their byte-array arguments, so a
caller that passes an
+invalid array reference or an out-of-range
<code>off</code>/<code>len</code> to the native XXHash
methods can crash the JVM.
+It affects <code>lz4-java</code> ≤ 1.11.0
…</p></summary><content type="html"><p>CVE-2026-59949 (CVSS 6.5) is
an out-of-bounds read in the <code>lz4-java</code> codec: the
JNI-based XXHash
+implementations insufficiently validate their byte-array arguments, so a
caller that passes an
+invalid array reference or an out-of-range
<code>off</code>/<code>len</code> to the native XXHash
methods can crash the JVM.
+It affects <code>lz4-java</code> ≤ 1.11.0 (fixed in 1.11.1).
Exploitation requires an application to pass
+attacker-influenced array/offset/length values into those XXHash
APIs.</p>
+<p>Solr is <strong>not affected</strong>.
<code>lz4-java</code> is bundled only by the optional
<code>cross-dc</code> module, where it is
+used by the embedded Apache Kafka client for LZ4 compression / checksums of
cross-datacenter
+replication messages. Kafka calls the XXHash APIs with its own
internally-managed, validated buffers
+and offsets — it does not forward attacker-controlled
<code>off</code>/<code>len</code> values into the
native methods — and
+the replication stream flows through an operator-controlled Kafka pipeline,
not untrusted external
+input. The <code>cross-dc</code> module is not part of a default
Solr installation, and no Solr request path
+reaches the vulnerable XXHash argument handling.</p>
+<p>Solr shipped an affected <code>org.lz4:lz4-java</code>
1.8.0 from 9.8.0 (when the <code>cross-dc</code> module first
bundled
+it) through 10.0.0. Unlike CVE-2025-12183 / CVE-2025-66566 (covered separately
and fixed by the
+<code>branch_9x</code> / <code>branch_10x</code> /
<code>main</code> migration to the fork
<code>at.yawk.lz4:lz4-java</code> 1.10.1), <strong>this issue
+is not yet fixed on any branch</strong>: 1.11.1 is required, and all
three development branches are on 1.10.1,
+so the upcoming 9.11 and 10.1 releases will still bundle an affected version.
The affected Solr range
+will need to extend to those releases once they
ship.</p></content><category
term="solr/vex"/></entry><entry><title>Eclipse Jetty: HTTP/2 :authority vs Host
header confusion</title><link href="/cve-2026-6790.html"
rel="alternate"/><published>2026-07-31T00:00:00+00:00</published><updated>2026-07-31T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-07-31:/cve-2026-6790.html</id><summary
type="html"><p>CVE-2026-6790 is an input-validation gap [...]
does not require the <code>:authority</code> pseudo-header to
match the <code>Host</code> header, so a single request can
carry two conflicting host interpretations. It affects the Jetty branches Solr
ships (9.4.x, 10.0.x
through …</p></summary><content type="html"><p>CVE-2026-6790 is an
input-validation gap in Jetty's HTTP/2 (and HTTP/3) request processing: Jetty
@@ -2355,29 +2395,4 @@ CVE - <a
href="https://nvd.nist.gov/vuln/detail/CVE-2023-50386">CVE-2023-5
<p>Please refer to the Upgrade Notes in the Solr Ref Guide for
information on upgrading from previous Solr versions:</p>
<p><a
href="https://solr.apache.org/guide/solr/9_4/upgrade-notes/solr-upgrade-notes.html">https://solr.apache.org/guide/solr/9_4/upgrade-notes/solr-upgrade-notes.html</a></p>
<p>Please read CHANGES.txt for a full list of bugfixes:</p>
-<p><a
href="https://solr.apache.org/9_4_1/changes/Changes.html">https://solr.apache.org/9_4_1/changes/Changes.html</a></p></content><category
term="solr/news"/></entry><entry><title>CVE-2023-50290: Apache Solr allows
read access to host environment variables</title><link
href="/cve-2023-50290-apache-solr-allows-read-access-to-host-environment-variables.html"
rel="alternate"/><published>2024-01-12T00:00:00+00:00</published><updated>2024-01-12T00:00:00+00:00</update
[...]
-Important</p>
-<p><strong>Versions Affected:</strong><br>
-Solr 9.0 to 9.2.1</p>
-<p><strong>Description:</strong><br>
-Exposure of Sensitive Information to an Unauthorized Actor vulnerability in
Apache Solr.
-The Solr Metrics API publishes all unprotected environment variables available
to each Apache Solr instance.
-Users are able to specify which environment variables to hide, however
…</p></summary><content
type="html"><p><strong>Severity:</strong><br>
-Important</p>
-<p><strong>Versions Affected:</strong><br>
-Solr 9.0 to 9.2.1</p>
-<p><strong>Description:</strong><br>
-Exposure of Sensitive Information to an Unauthorized Actor vulnerability in
Apache Solr.
-The Solr Metrics API publishes all unprotected environment variables available
to each Apache Solr instance.
-Users are able to specify which environment variables to hide, however, the
default list is designed to work for known secret Java system properties.
-Environment variables cannot be strictly defined in Solr, like Java system
properties can be, and may be set for the entire host, unlike Java system
properties which are set per-Java-process.</p>
-<p>The Solr Metrics API is protected by the "metrics-read" permission.
-Therefore, Solr Clouds with Authorization setup will only be vulnerable via
users with the "metrics-read" permission.</p>
-<p><strong>Mitigation:</strong><br>
-Users are recommended to upgrade to version 9.3.0 or later, in which
environment variables are not published via the Metrics API.</p>
-<p><strong>References:</strong><br>
-JIRA - <a
href="https://issues.apache.org/jira/browse/SOLR-16808">SOLR-15233</a><br>
-CVE - <a
href="https://nvd.nist.gov/vuln/detail/CVE-2023-50290">CVE-2023-50290</a></p></content><category
term="solr/security"/></entry><entry><title>json-path</title><link
href="/cve-2023-51074.html"
rel="alternate"/><published>2024-01-12T00:00:00+00:00</published><updated>2024-01-12T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2024-01-12:/cve-2023-51074.html</id><summary
type="html"><p>The only places we use json-path is for [...]
-<p>CVE-2023-51074 affects json-path 2.2.0 through 2.8.0 (fixed in
2.9.0). Solr first bundled json-path
-in Solr 8.1.0 (2.4.0) and shipped an affected version — 2.4.0, then 2.7.0,
then 2.8.0 — through Solr
-9.5.0; Solr 9.6.0 upgraded to the fixed 2.9.0. The affected range is therefore
8.1.0 – 9.5.0.</p></content><category term="solr/vex"/></entry></feed>
\ No newline at end of file
+<p><a
href="https://solr.apache.org/9_4_1/changes/Changes.html">https://solr.apache.org/9_4_1/changes/Changes.html</a></p></content><category
term="solr/news"/></entry></feed>
\ No newline at end of file
diff --git a/output/feeds/solr/vex.atom.xml b/output/feeds/solr/vex.atom.xml
index 8e8c3d5ea..ccb7ccd14 100644
--- a/output/feeds/solr/vex.atom.xml
+++ b/output/feeds/solr/vex.atom.xml
@@ -1,5 +1,52 @@
<?xml version="1.0" encoding="utf-8"?>
-<feed xmlns="http://www.w3.org/2005/Atom";><title>Apache Solr -
solr/vex</title><link href="/" rel="alternate"/><link
href="/feeds/solr/vex.atom.xml"
rel="self"/><id>/</id><updated>2026-07-31T00:00:00+00:00</updated><entry><title>Apache
Avro (Java): RCE reading a crafted schema / DoS deserializing untrusted
data</title><link href="/cve-2024-47561.html"
rel="alternate"/><published>2026-07-31T00:00:00+00:00</published><updated>2026-07-31T00:00:00+00:00</updated><author><name>Solr
Developers [...]
+<feed xmlns="http://www.w3.org/2005/Atom";><title>Apache Solr -
solr/vex</title><link href="/" rel="alternate"/><link
href="/feeds/solr/vex.atom.xml"
rel="self"/><id>/</id><updated>2026-08-13T00:00:00+00:00</updated><entry><title>lz4-java:
out-of-bounds memory access and insufficient buffer clearing in
compression/decompression</title><link href="/cve-2025-12183.html"
rel="alternate"/><published>2026-08-13T00:00:00+00:00</published><updated>2026-08-13T00:00:00+00:00</updated><author><name
[...]
+<ul>
+<li><strong>CVE-2025-12183</strong> — several lz4-java
compression/decompression implementations do not guard against
+ out-of-bounds memory access (fixed in <code>lz4-java</code>
1.8.1).</li>
+<li><strong>CVE-2025-66566</strong> — decompressor
implementations insufficiently clear their buffers, allowing a
+ caller to read leftover contents of a previously used buffer (fixed in
<code>lz4-java</code> 1.10.1
…</li></ul></summary><content type="html"><p>Two issues in
the <code>lz4-java</code> codec:</p>
+<ul>
+<li><strong>CVE-2025-12183</strong> — several lz4-java
compression/decompression implementations do not guard against
+ out-of-bounds memory access (fixed in <code>lz4-java</code>
1.8.1).</li>
+<li><strong>CVE-2025-66566</strong> — decompressor
implementations insufficiently clear their buffers, allowing a
+ caller to read leftover contents of a previously used buffer (fixed in
<code>lz4-java</code> 1.10.1).</li>
+</ul>
+<p>Both require an application to drive lz4-java's (de)compression APIs
with attacker-influenced
+input/buffers.</p>
+<p>Solr is <strong>not affected</strong>.
<code>lz4-java</code> is bundled only by the optional
<code>cross-dc</code> module, where it is
+used by the embedded Apache Kafka client for LZ4 compression of
cross-datacenter replication messages.
+Kafka manages its own internal, validated buffers and does not forward
attacker-controlled data into
+the vulnerable code paths, and the replication stream flows through an
operator-controlled Kafka
+pipeline rather than untrusted external input. The
<code>cross-dc</code> module is not part of a default Solr
+installation, and no Solr request path reaches these lz4-java
routines.</p>
+<p>Solr shipped an affected <code>org.lz4:lz4-java</code>
1.8.0 from 9.8.0 (when the <code>cross-dc</code> module first
bundled
+it) through 10.0.0; releases 9.7.0 and earlier, and the 8.x line, ship no
<code>lz4-java</code>. The fix is
+already on all active development branches:
<code>branch_9x</code>, <code>branch_10x</code>, and
<code>main</code> migrated to the
+maintained community fork <code>at.yawk.lz4:lz4-java</code>
1.10.1, which is past both fixes (1.8.1 and 1.10.1),
+so the next releases (9.11, 10.1) will not be affected. Note this upgrade did
not require Apache Kafka
+to update first — Kafka still declares the old
<code>org.lz4:lz4-java</code>, and Solr replaced that transitive
+dependency with the fork directly.</p></content><category
term="solr/vex"/></entry><entry><title>Woodstox: denial-of-service (stack
overflow) parsing untrusted XML when DTD support is enabled</title><link
href="/cve-2022-40152.html"
rel="alternate"/><published>2026-08-11T00:00:00+00:00</published><updated>2026-08-11T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-08-11:/cve-2022-40152.html</id><summary
type="html"><p>CVE-2022-40152 (CVSS [...]
+(<code>com.fasterxml.woodstox:woodstox-core</code>): when DTD
support is enabled, a client can supply XML whose
+<code>DOCTYPE</code> internal subset contains a deeply-nested
element content model, causing the parser to
+recurse until it throws a <code>StackOverflowError</code>. It
affects <code>woodstox-core …</code></p></summary><content
type="html"><p>CVE-2022-40152 (CVSS 6.5) is a denial-of-service issue in
the Woodstox XML parser
+(<code>com.fasterxml.woodstox:woodstox-core</code>): when DTD
support is enabled, a client can supply XML whose
+<code>DOCTYPE</code> internal subset contains a deeply-nested
element content model, causing the parser to
+recurse until it throws a <code>StackOverflowError</code>. It
affects <code>woodstox-core</code> before 5.4.0 and 6.0.0 –
+6.3.x, and is fixed in 5.4.0 and 6.4.0.</p>
+<p>Solr <strong>9.0.0 and 9.1.0 are affected.</strong> Those
two releases shipped <code>woodstox-core</code> 6.2.8 (&lt;
6.4.0), and
+Solr's XML update handler (<code>XMLLoader</code>, serving the
untrusted <code>/update</code> request path) configures its
+StAX input factory via
<code>EmptyEntityResolver.configureXMLInputFactory</code>. That
configuration neutralizes
+external entities — so Solr is <em>not</em> exposed to XXE — but
it does <strong>not</strong> disable DTD processing, so
+the parser still reads the internal DTD subset. A client that POSTs crafted
XML with a deeply-nested
+DTD to <code>/update</code> can therefore reach the vulnerable
code and trigger the stack-overflow DoS. Because
+the vulnerable path is reachable with attacker-controlled input, these
releases are marked
+<code>exploitable</code> rather than
<code>not_affected</code>.</p>
+<p><strong>Remediation: upgrade to Apache Solr 9.1.1 or
later.</strong> Solr 9.1.1 upgraded to
<code>woodstox-core</code> 6.4.0
+(past the fix), and every later release ships a fixed version (6.5.0 in 9.2.0,
7.0.0 in current 9.x,
+7.1.1 in 10.0.0), so no release from 9.1.1 onward is affected. Solr 8.x and
earlier are out of scope
+for this CVE: they used the unrelated
<code>org.codehaus.woodstox:woodstox-core-asl</code> artifact, not
+<code>com.fasterxml.woodstox:woodstox-core</code> (the migration
in SOLR-10702 introduced the affected artifact
+at 9.0.0). Solr 9.0.0 and 9.1.0 are both end of
life.</p></content><category
term="solr/vex"/></entry><entry><title>Apache Avro (Java): RCE reading a
crafted schema / DoS deserializing untrusted data</title><link
href="/cve-2024-47561.html"
rel="alternate"/><published>2026-07-31T00:00:00+00:00</published><updated>2026-07-31T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-07-31:/cve-2024-47561.html</id><summary
type="html"><p>CVE-2024-475 [...]
an attacker-controlled Avro <strong>schema</strong> can
instantiate arbitrary classes (affects avro &lt; 1.11.4).
CVE-2023-39410 is a memory-exhaustion / DoS issue when
<strong>deserializing untrusted Avro data</strong> (affects
avro &lt; 1.11.3). Both require the application to feed
attacker-controlled Avro …</p></summary><content
type="html"><p>CVE-2024-47561 (critical) is an arbitrary-code-execution
issue in the Apache Avro Java SDK: parsing
@@ -257,34 +304,27 @@ Netty &lt; 4.1.136 and 4.2.0–4.2.15, fixed in 4.1.136
/ 4.2.16):</p>
<p>Solr is <strong>not affected</strong>. Solr bundles Netty
only via the optional OpenTelemetry (OTLP) exporter and
the ZooKeeper client, where Netty is used strictly as a
<strong>client</strong>. Solr's HTTP server is Jetty:
Solr never runs a Netty HTTP server, CORS handler, WebSocket server, or
HTTP/2→1 proxy, and never
-uses Netty's multipart request encoder, so none of these code paths are
reachable.</p></content><category
term="solr/vex"/></entry><entry><title>lz4-java: out-of-bounds access and
buffer-reuse disclosure in (de)compression</title><link
href="/cve-2026-59949.html"
rel="alternate"/><published>2026-07-31T00:00:00+00:00</published><updated>2026-07-31T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-07-31:/cve-2026-59949.html</id><summary
type="html [...]
-lz4-java):</p>
-<ul>
-<li><strong>CVE-2026-59949</strong> (CVSS 6.5) —
out-of-bounds read: the JNI-based XXHash implementations don't
- validate their byte-array arguments, so a caller passing an invalid array
reference or out-of-range
- <code>off</code>/<code>len</code> can crash the JVM
(fixed in 1 …</li></ul></summary><content
type="html"><p>Three issues in the
<code>at.yawk.lz4:lz4-java</code> codec (the community-maintained
fork of the discontinued
-lz4-java):</p>
-<ul>
-<li><strong>CVE-2026-59949</strong> (CVSS 6.5) —
out-of-bounds read: the JNI-based XXHash implementations don't
- validate their byte-array arguments, so a caller passing an invalid array
reference or out-of-range
- <code>off</code>/<code>len</code> can crash the JVM
(fixed in 1.11.1).</li>
-<li><strong>CVE-2025-12183</strong> — out-of-bounds memory
access in the compression/decompression functions,
- leading to denial of service and possible information disclosure when
processing untrusted input
- (fixed in 1.8.1).</li>
-<li><strong>CVE-2025-66566</strong> — the Java decompressor
does not clear reused output buffers, so crafted
- compressed input can read previous buffer contents when an output buffer is
reused (fixed in
- 1.10.1).</li>
-</ul>
-<p>All three affect the <code>lz4-java</code> 1.8.0 that
Solr's released 9.8.0 – 10.0.0 line bundles (SOLR-18013
-tracks the upgrade to 1.10.1). Each is reachable only when an application
feeds attacker-controlled
-input to the codec, or passes attacker-influenced arguments into it.</p>
-<p>Solr is <strong>not affected</strong>.
<code>lz4-java</code> is bundled only by the optional
<code>cross-dc</code> module, where the
-embedded Apache Kafka client uses it to (de)compress and checksum
cross-datacenter replication
-messages. Those messages flow through an
<strong>operator-controlled</strong> Kafka pipeline (Solr's own
cross-DC
-producer → the operator's Kafka → Solr's consumer), not untrusted external
input, and Kafka calls the
-codec with its own internally-managed, validated buffers and offsets rather
than forwarding
-attacker-controlled arguments. The <code>cross-dc</code> module is
not part of a default Solr installation, and
-no Solr request path reaches the vulnerable compression/decompression or
XXHash code.</p></content><category
term="solr/vex"/></entry><entry><title>Eclipse Jetty: HTTP/2 :authority vs Host
header confusion</title><link href="/cve-2026-6790.html"
rel="alternate"/><published>2026-07-31T00:00:00+00:00</published><updated>2026-07-31T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-07-31:/cve-2026-6790.html</id><summary
type="html"><p>CVE-2026 [...]
+uses Netty's multipart request encoder, so none of these code paths are
reachable.</p></content><category
term="solr/vex"/></entry><entry><title>lz4-java: out-of-bounds read via invalid
arguments to native XXHash</title><link href="/cve-2026-59949.html"
rel="alternate"/><published>2026-07-31T00:00:00+00:00</published><updated>2026-07-31T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-07-31:/cve-2026-59949.html</id><summary
type="html"><p> [...]
+implementations insufficiently validate their byte-array arguments, so a
caller that passes an
+invalid array reference or an out-of-range
<code>off</code>/<code>len</code> to the native XXHash
methods can crash the JVM.
+It affects <code>lz4-java</code> ≤ 1.11.0
…</p></summary><content type="html"><p>CVE-2026-59949 (CVSS 6.5) is
an out-of-bounds read in the <code>lz4-java</code> codec: the
JNI-based XXHash
+implementations insufficiently validate their byte-array arguments, so a
caller that passes an
+invalid array reference or an out-of-range
<code>off</code>/<code>len</code> to the native XXHash
methods can crash the JVM.
+It affects <code>lz4-java</code> ≤ 1.11.0 (fixed in 1.11.1).
Exploitation requires an application to pass
+attacker-influenced array/offset/length values into those XXHash
APIs.</p>
+<p>Solr is <strong>not affected</strong>.
<code>lz4-java</code> is bundled only by the optional
<code>cross-dc</code> module, where it is
+used by the embedded Apache Kafka client for LZ4 compression / checksums of
cross-datacenter
+replication messages. Kafka calls the XXHash APIs with its own
internally-managed, validated buffers
+and offsets — it does not forward attacker-controlled
<code>off</code>/<code>len</code> values into the
native methods — and
+the replication stream flows through an operator-controlled Kafka pipeline,
not untrusted external
+input. The <code>cross-dc</code> module is not part of a default
Solr installation, and no Solr request path
+reaches the vulnerable XXHash argument handling.</p>
+<p>Solr shipped an affected <code>org.lz4:lz4-java</code>
1.8.0 from 9.8.0 (when the <code>cross-dc</code> module first
bundled
+it) through 10.0.0. Unlike CVE-2025-12183 / CVE-2025-66566 (covered separately
and fixed by the
+<code>branch_9x</code> / <code>branch_10x</code> /
<code>main</code> migration to the fork
<code>at.yawk.lz4:lz4-java</code> 1.10.1), <strong>this issue
+is not yet fixed on any branch</strong>: 1.11.1 is required, and all
three development branches are on 1.10.1,
+so the upcoming 9.11 and 10.1 releases will still bundle an affected version.
The affected Solr range
+will need to extend to those releases once they
ship.</p></content><category
term="solr/vex"/></entry><entry><title>Eclipse Jetty: HTTP/2 :authority vs Host
header confusion</title><link href="/cve-2026-6790.html"
rel="alternate"/><published>2026-07-31T00:00:00+00:00</published><updated>2026-07-31T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-07-31:/cve-2026-6790.html</id><summary
type="html"><p>CVE-2026-6790 is an input-validation gap [...]
does not require the <code>:authority</code> pseudo-header to
match the <code>Host</code> header, so a single request can
carry two conflicting host interpretations. It affects the Jetty branches Solr
ships (9.4.x, 10.0.x
through …</p></summary><content type="html"><p>CVE-2026-6790 is an
input-validation gap in Jetty's HTTP/2 (and HTTP/3) request processing: Jetty
@@ -1647,12 +1687,4 @@ performed variable interpolation with
<code>script</code>, <code&
2.8.0). Only Solr 9.0.0 shipped an affected version
(<code>commons-configuration2</code> 2.7); Solr 8.x shipped
2.1.1 (before the flaw was introduced) and Solr 9.1.0 upgraded to the fixed
2.8.0. The affected
version is therefore 9.0.0 only.</p>
-<p>Solr uses commons-configuration2 for "hadoop-auth" only (for
Kerberos). It is only used for loading Hadoop configuration files that would
only ever be provided by trusted administrators, not externally
(untrusted).</p></content><category
term="solr/vex"/></entry><entry><title>calcite</title><link
href="/cve-2022-39135.html"
rel="alternate"/><published>2022-12-14T00:00:00+00:00</published><updated>2022-12-14T00:00:00+00:00</updated><author><name>Solr
Developers</name></auth [...]
-through 1.9, the default <code>StringSubstitutor</code>
interpolators included <code>script</code>,
<code>dns</code> and <code>url</code>
-lookups that could execute arbitrary code (fixed in 1.10.0). Solr bundled an
affected <code>commons-text</code>
-in 8.1.0 (1.6) through 9 …</p></summary><content
type="html"><p>CVE-2022-42889 ("Text4Shell") is a code-execution issue in
Apache Commons Text: from version 1.5
-through 1.9, the default <code>StringSubstitutor</code>
interpolators included <code>script</code>,
<code>dns</code> and <code>url</code>
-lookups that could execute arbitrary code (fixed in 1.10.0). Solr bundled an
affected <code>commons-text</code>
-in 8.1.0 (1.6) through 9.0.0 (1.8); Solr 8.0.0 shipped 1.4 (before the flaw
was introduced) and Solr
-9.1.0 upgraded to the fixed 1.10.0. The affected range is therefore 8.1.0 –
9.0.0.</p>
-<p>Solr uses commons-text directly (StringEscapeUtils.escapeEcmaScript)
in LoadAdminUiServlet that is not vulnerable. Solr also has a "hadoop-auth"
module that uses Apache Hadoop which uses commons-text through
commons-configuration2. For Solr, the concern is limited to loading Hadoop
configuration files that would only ever be provided by trusted administrators,
not externally (untrusted).</p></content><category
term="solr/vex"/></entry></feed>
\ No newline at end of file
+<p>Solr uses commons-configuration2 for "hadoop-auth" only (for
Kerberos). It is only used for loading Hadoop configuration files that would
only ever be provided by trusted administrators, not externally
(untrusted).</p></content><category term="solr/vex"/></entry></feed>
\ No newline at end of file
diff --git a/output/security-dependency-cves.html
b/output/security-dependency-cves.html
index 8667d5460..143f736c4 100644
--- a/output/security-dependency-cves.html
+++ b/output/security-dependency-cves.html
@@ -191,6 +191,24 @@ or contact <a
href="mailto:[email protected]";>[email protected]</a>.</p>
</tr>
<tr>
<td>
+<a href="https://nvd.nist.gov/vuln/detail/CVE-2025-12183";>CVE-2025-12183</a>,
<a href="https://nvd.nist.gov/vuln/detail/CVE-2025-66566";>CVE-2025-66566</a>
</td>
+ <td>9.8.0-10.0.0</td>
+ <td>
+ lz4-java-1.8.0.jar </td>
+ <td><span class="cdx-not-affected">not affected</span></td>
+ <td><a href="/vex.html#cve-2025-12183">lz4-java: out-of-bounds memory
access and insufficient buffer clearing in compression/decompression</a></td>
+ </tr>
+ <tr>
+ <td>
+<a href="https://nvd.nist.gov/vuln/detail/CVE-2022-40152";>CVE-2022-40152</a>
</td>
+ <td>9.0.0-9.1.0</td>
+ <td>
+ woodstox-core-6.2.8.jar </td>
+ <td><span class="cdx-exploitable">exploitable</span></td>
+ <td><a href="/vex.html#cve-2022-40152">Woodstox: denial-of-service
(stack overflow) parsing untrusted XML when DTD support is enabled</a></td>
+ </tr>
+ <tr>
+ <td>
<a
href="https://github.com/advisories/GHSA-mhm7-754m-9p8w";>GHSA-mhm7-754m-9p8w</a>
</td>
<td>9.8.0-9.10.1</td>
<td>
@@ -218,12 +236,12 @@ or contact <a
href="mailto:[email protected]";>[email protected]</a>.</p>
</tr>
<tr>
<td>
-<a href="https://nvd.nist.gov/vuln/detail/CVE-2026-59949";>CVE-2026-59949</a>,
<a href="https://nvd.nist.gov/vuln/detail/CVE-2025-12183";>CVE-2025-12183</a>,
<a href="https://nvd.nist.gov/vuln/detail/CVE-2025-66566";>CVE-2025-66566</a>
</td>
+<a href="https://nvd.nist.gov/vuln/detail/CVE-2026-59949";>CVE-2026-59949</a>
</td>
<td>9.8.0-10.0.0</td>
<td>
lz4-java-1.8.0.jar </td>
<td><span class="cdx-not-affected">not affected</span></td>
- <td><a href="/vex.html#cve-2026-59949">lz4-java: out-of-bounds access
and buffer-reuse disclosure in (de)compression</a></td>
+ <td><a href="/vex.html#cve-2026-59949">lz4-java: out-of-bounds read via
invalid arguments to native XXHash</a></td>
</tr>
<tr>
<td>
diff --git a/output/solr.openvex.json b/output/solr.openvex.json
index 8ed0cc85f..880131c75 100644
--- a/output/solr.openvex.json
+++ b/output/solr.openvex.json
@@ -2,7 +2,7 @@
"@context": "https://openvex.dev/ns/v0.2.0";,
"@id": "https://solr.apache.org/solr.openvex.json";,
"author": "Apache Solr Project ([email protected])",
- "timestamp": "2026-07-31T00:00:00Z",
+ "timestamp": "2026-08-13T00:00:00Z",
"version": 1,
"statements": [
{
@@ -4176,43 +4176,13 @@
},
"products": [
{
- "@id": "lz4-java-1.8.0.jar"
+ "@id": "pkg:maven/org.lz4/[email protected]"
}
],
"status": "not_affected",
"timestamp": "2026-07-31T00:00:00Z",
"justification": "vulnerable_code_not_in_execute_path",
- "impact_statement": "Three issues in the `at.yawk.lz4:lz4-java` codec
(the community-maintained fork of the discontinued\nlz4-java):\n\n*
**CVE-2026-59949** (CVSS 6.5) \u2014 out-of-bounds read: the JNI-based XXHash
implementations don't\n validate their byte-array arguments, so a caller
passing an invalid array reference or out-of-range\n `off`/`len` can crash the
JVM (fixed in 1.11.1).\n* **CVE-2025-12183** \u2014 out-of-bounds memory access
in the compression/decompression fun [...]
- "status_notes": "Affected Apache Solr versions: 9.8.0-10.0.0."
- },
- {
- "vulnerability": {
- "name": "CVE-2025-12183"
- },
- "products": [
- {
- "@id": "lz4-java-1.8.0.jar"
- }
- ],
- "status": "not_affected",
- "timestamp": "2026-07-31T00:00:00Z",
- "justification": "vulnerable_code_not_in_execute_path",
- "impact_statement": "Three issues in the `at.yawk.lz4:lz4-java` codec
(the community-maintained fork of the discontinued\nlz4-java):\n\n*
**CVE-2026-59949** (CVSS 6.5) \u2014 out-of-bounds read: the JNI-based XXHash
implementations don't\n validate their byte-array arguments, so a caller
passing an invalid array reference or out-of-range\n `off`/`len` can crash the
JVM (fixed in 1.11.1).\n* **CVE-2025-12183** \u2014 out-of-bounds memory access
in the compression/decompression fun [...]
- "status_notes": "Affected Apache Solr versions: 9.8.0-10.0.0."
- },
- {
- "vulnerability": {
- "name": "CVE-2025-66566"
- },
- "products": [
- {
- "@id": "lz4-java-1.8.0.jar"
- }
- ],
- "status": "not_affected",
- "timestamp": "2026-07-31T00:00:00Z",
- "justification": "vulnerable_code_not_in_execute_path",
- "impact_statement": "Three issues in the `at.yawk.lz4:lz4-java` codec
(the community-maintained fork of the discontinued\nlz4-java):\n\n*
**CVE-2026-59949** (CVSS 6.5) \u2014 out-of-bounds read: the JNI-based XXHash
implementations don't\n validate their byte-array arguments, so a caller
passing an invalid array reference or out-of-range\n `off`/`len` can crash the
JVM (fixed in 1.11.1).\n* **CVE-2025-12183** \u2014 out-of-bounds memory access
in the compression/decompression fun [...]
+ "impact_statement": "CVE-2026-59949 (CVSS 6.5) is an out-of-bounds read
in the `lz4-java` codec: the JNI-based XXHash\nimplementations insufficiently
validate their byte-array arguments, so a caller that passes an\ninvalid array
reference or an out-of-range `off`/`len` to the native XXHash methods can crash
the JVM.\nIt affects `lz4-java` \u2264 1.11.0 (fixed in 1.11.1). Exploitation
requires an application to pass\nattacker-influenced array/offset/length values
into those XXHash A [...]
"status_notes": "Affected Apache Solr versions: 9.8.0-10.0.0."
},
{
@@ -4309,6 +4279,50 @@
"timestamp": "2026-07-31T00:00:00Z",
"impact_statement": "GHSA-mhm7-754m-9p8w is a deserialization-filter
bypass in jackson-databind: a `@JsonView` restriction\ncan be bypassed for
creator properties that use `@JsonTypeInfo(include =
As.EXTERNAL_PROPERTY)`\npolymorphic typing, letting untrusted JSON populate
fields the active view was meant to exclude. It\naffects jackson-databind
2.18.0 \u2013 2.18.8 and 2.21.0 \u2013 2.21.4 (fixed in 2.18.9 / 2.21.5);
the\nexternal-type-id creator path was fixed on the 3.x line and [...]
"status_notes": "Affected Apache Solr versions: 9.8.0-9.10.1."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2022-40152"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/com.fasterxml.woodstox/[email protected]"
+ }
+ ],
+ "status": "affected",
+ "timestamp": "2026-08-11T00:00:00Z",
+ "action_statement": "CVE-2022-40152 (CVSS 6.5) is a denial-of-service
issue in the Woodstox XML parser\n(`com.fasterxml.woodstox:woodstox-core`):
when DTD support is enabled, a client can supply XML whose\n`DOCTYPE` internal
subset contains a deeply-nested element content model, causing the parser
to\nrecurse until it throws a `StackOverflowError`. It affects `woodstox-core`
before 5.4.0 and 6.0.0 \u2013\n6.3.x, and is fixed in 5.4.0 and 6.4.0.\n\nSolr
**9.0.0 and 9.1.0 are affecte [...]
+ "status_notes": "Affected Apache Solr versions: 9.0.0-9.1.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2025-12183"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.lz4/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-08-13T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "Two issues in the `lz4-java` codec:\n\n*
**CVE-2025-12183** \u2014 several lz4-java compression/decompression
implementations do not guard against\n out-of-bounds memory access (fixed in
`lz4-java` 1.8.1).\n* **CVE-2025-66566** \u2014 decompressor implementations
insufficiently clear their buffers, allowing a\n caller to read leftover
contents of a previously used buffer (fixed in `lz4-java` 1.10.1).\n\nBoth
require an application to drive lz4-java's (de)comp [...]
+ "status_notes": "Affected Apache Solr versions: 9.8.0-10.0.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2025-66566"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.lz4/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-08-13T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "Two issues in the `lz4-java` codec:\n\n*
**CVE-2025-12183** \u2014 several lz4-java compression/decompression
implementations do not guard against\n out-of-bounds memory access (fixed in
`lz4-java` 1.8.1).\n* **CVE-2025-66566** \u2014 decompressor implementations
insufficiently clear their buffers, allowing a\n caller to read leftover
contents of a previously used buffer (fixed in `lz4-java` 1.10.1).\n\nBoth
require an application to drive lz4-java's (de)comp [...]
+ "status_notes": "Affected Apache Solr versions: 9.8.0-10.0.0."
}
]
}
\ No newline at end of file
diff --git a/output/solr.vex.json b/output/solr.vex.json
index 4a43dbd41..982b10bd0 100644
--- a/output/solr.vex.json
+++ b/output/solr.vex.json
@@ -7,7 +7,7 @@
"name": "solr",
"version": "SNAPSHOT",
"type": "application",
- "bom-ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "bom-ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
},
"vulnerabilities": [
@@ -23,7 +23,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -39,7 +39,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -55,7 +55,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -71,7 +71,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -87,7 +87,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -103,7 +103,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -119,7 +119,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -135,7 +135,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -151,7 +151,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -167,7 +167,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -183,7 +183,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -199,7 +199,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -215,7 +215,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -231,7 +231,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -247,7 +247,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -263,7 +263,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -279,7 +279,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -295,7 +295,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -311,7 +311,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -327,7 +327,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -343,7 +343,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -359,7 +359,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -375,7 +375,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -391,7 +391,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -407,7 +407,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -423,7 +423,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -439,7 +439,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -455,7 +455,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -471,7 +471,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -487,7 +487,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -503,7 +503,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -519,7 +519,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -535,7 +535,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -551,7 +551,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -567,7 +567,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -583,7 +583,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -599,7 +599,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -615,7 +615,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -631,7 +631,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -647,7 +647,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -663,7 +663,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -679,7 +679,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -695,7 +695,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -711,7 +711,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -727,7 +727,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -743,7 +743,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -759,7 +759,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -775,7 +775,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -791,7 +791,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -807,7 +807,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -823,7 +823,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -839,7 +839,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -855,7 +855,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -871,7 +871,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -887,7 +887,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -903,7 +903,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -919,7 +919,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -935,7 +935,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -951,7 +951,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -970,7 +970,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -986,7 +986,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1002,7 +1002,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1018,7 +1018,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1037,7 +1037,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1053,7 +1053,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1070,7 +1070,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1087,7 +1087,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1104,7 +1104,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1121,7 +1121,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1138,7 +1138,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1155,7 +1155,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1172,7 +1172,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1189,7 +1189,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1206,7 +1206,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1223,7 +1223,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1240,7 +1240,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1257,7 +1257,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1274,7 +1274,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1291,7 +1291,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1308,7 +1308,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1325,7 +1325,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1342,7 +1342,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1359,7 +1359,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1376,7 +1376,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1393,7 +1393,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1410,7 +1410,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1427,7 +1427,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1444,7 +1444,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1464,7 +1464,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1484,7 +1484,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1504,7 +1504,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1521,7 +1521,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1541,7 +1541,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1558,7 +1558,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1575,7 +1575,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1592,7 +1592,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1609,7 +1609,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1626,7 +1626,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1643,7 +1643,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1660,7 +1660,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1677,7 +1677,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1694,7 +1694,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1711,7 +1711,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1728,7 +1728,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1745,7 +1745,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1762,7 +1762,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1779,7 +1779,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1796,7 +1796,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1813,7 +1813,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1830,7 +1830,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1847,7 +1847,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1864,7 +1864,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1881,7 +1881,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1898,7 +1898,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1915,7 +1915,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1932,7 +1932,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1949,7 +1949,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1966,7 +1966,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -1983,7 +1983,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -2000,7 +2000,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -2017,7 +2017,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -2034,7 +2034,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -2051,7 +2051,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -2068,7 +2068,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -2085,7 +2085,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -2102,7 +2102,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -2119,7 +2119,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -2136,7 +2136,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -2153,7 +2153,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -2170,7 +2170,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -2187,7 +2187,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -2204,7 +2204,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -2221,7 +2221,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -2238,7 +2238,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -2255,7 +2255,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -2272,7 +2272,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -2289,7 +2289,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -2306,7 +2306,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -2323,7 +2323,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -2340,7 +2340,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -2357,7 +2357,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -2374,7 +2374,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -2391,7 +2391,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -2408,7 +2408,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -2425,7 +2425,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -2442,7 +2442,7 @@
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
@@ -2455,96 +2455,115 @@
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
- "detail": "Three issues in the `at.yawk.lz4:lz4-java` codec (the
community-maintained fork of the discontinued\nlz4-java):\n\n*
**CVE-2026-59949** (CVSS 6.5) \u2014 out-of-bounds read: the JNI-based XXHash
implementations don't\n validate their byte-array arguments, so a caller
passing an invalid array reference or out-of-range\n `off`/`len` can crash the
JVM (fixed in 1.11.1).\n* **CVE-2025-12183** \u2014 out-of-bounds memory access
in the compression/decompression functions,\ [...]
+ "detail": "CVE-2026-59949 (CVSS 6.5) is an out-of-bounds read in the
`lz4-java` codec: the JNI-based XXHash\nimplementations insufficiently validate
their byte-array arguments, so a caller that passes an\ninvalid array reference
or an out-of-range `off`/`len` to the native XXHash methods can crash the
JVM.\nIt affects `lz4-java` \u2264 1.11.0 (fixed in 1.11.1). Exploitation
requires an application to pass\nattacker-influenced array/offset/length values
into those XXHash APIs.\n\n [...]
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
{
- "id": "CVE-2025-12183",
+ "id": "CVE-2026-6790",
"source": {
"name": "NVD",
- "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12183";
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6790";
},
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
- "detail": "Three issues in the `at.yawk.lz4:lz4-java` codec (the
community-maintained fork of the discontinued\nlz4-java):\n\n*
**CVE-2026-59949** (CVSS 6.5) \u2014 out-of-bounds read: the JNI-based XXHash
implementations don't\n validate their byte-array arguments, so a caller
passing an invalid array reference or out-of-range\n `off`/`len` can crash the
JVM (fixed in 1.11.1).\n* **CVE-2025-12183** \u2014 out-of-bounds memory access
in the compression/decompression functions,\ [...]
+ "detail": "CVE-2026-6790 is an input-validation gap in Jetty's HTTP/2
(and HTTP/3) request processing: Jetty\ndoes not require the `:authority`
pseudo-header to match the `Host` header, so a single request can\ncarry two
conflicting host interpretations. It affects the Jetty branches Solr ships
(9.4.x, 10.0.x\nthrough 10.0.26, 12.0.x through 12.0.34). It has security
impact only for applications that **make\nsecurity-sensitive decisions based on
the request host** \u2014 host-bas [...]
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
{
- "id": "CVE-2025-66566",
+ "id": "CVE-2026-8384",
"source": {
"name": "NVD",
- "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66566";
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8384";
},
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
- "detail": "Three issues in the `at.yawk.lz4:lz4-java` codec (the
community-maintained fork of the discontinued\nlz4-java):\n\n*
**CVE-2026-59949** (CVSS 6.5) \u2014 out-of-bounds read: the JNI-based XXHash
implementations don't\n validate their byte-array arguments, so a caller
passing an invalid array reference or out-of-range\n `off`/`len` can crash the
JVM (fixed in 1.11.1).\n* **CVE-2025-12183** \u2014 out-of-bounds memory access
in the compression/decompression functions,\ [...]
+ "detail": "CVE-2026-8384 is a path-canonicalization flaw in Jetty's
`URIUtil.canonicalPath()`: a semicolon\npath-parameter marker before dot-dot
segments (e.g. `/public;/../admin/secret`) is not normalized,\nso a path-prefix
authorization check can be bypassed. It is exploitable by applications that
use\nJetty's `SecurityHandler.PathMapped`, or that make an authorization
decision on a canonicalized path\nat a **different layer** than the one that
ultimately dispatches the request [...]
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
{
- "id": "CVE-2026-6790",
+ "id": "GHSA-mhm7-754m-9p8w",
"source": {
- "name": "NVD",
- "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6790";
+ "name": "GITHUB",
+ "url": "https://github.com/advisories/GHSA-mhm7-754m-9p8w";
},
"analysis": {
"state": "not_affected",
- "justification": "code_not_reachable",
- "detail": "CVE-2026-6790 is an input-validation gap in Jetty's HTTP/2
(and HTTP/3) request processing: Jetty\ndoes not require the `:authority`
pseudo-header to match the `Host` header, so a single request can\ncarry two
conflicting host interpretations. It affects the Jetty branches Solr ships
(9.4.x, 10.0.x\nthrough 10.0.26, 12.0.x through 12.0.34). It has security
impact only for applications that **make\nsecurity-sensitive decisions based on
the request host** \u2014 host-bas [...]
+ "justification": "requires_configuration",
+ "detail": "GHSA-mhm7-754m-9p8w is a deserialization-filter bypass in
jackson-databind: a `@JsonView` restriction\ncan be bypassed for creator
properties that use `@JsonTypeInfo(include =
As.EXTERNAL_PROPERTY)`\npolymorphic typing, letting untrusted JSON populate
fields the active view was meant to exclude. It\naffects jackson-databind
2.18.0 \u2013 2.18.8 and 2.21.0 \u2013 2.21.4 (fixed in 2.18.9 / 2.21.5);
the\nexternal-type-id creator path was fixed on the 3.x line and not back [...]
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
{
- "id": "CVE-2026-8384",
+ "id": "CVE-2022-40152",
"source": {
"name": "NVD",
- "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8384";
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40152";
+ },
+ "analysis": {
+ "state": "exploitable",
+ "response": [
+ "update"
+ ],
+ "detail": "CVE-2022-40152 (CVSS 6.5) is a denial-of-service issue in
the Woodstox XML parser\n(`com.fasterxml.woodstox:woodstox-core`): when DTD
support is enabled, a client can supply XML whose\n`DOCTYPE` internal subset
contains a deeply-nested element content model, causing the parser to\nrecurse
until it throws a `StackOverflowError`. It affects `woodstox-core` before 5.4.0
and 6.0.0 \u2013\n6.3.x, and is fixed in 5.4.0 and 6.4.0.\n\nSolr **9.0.0 and
9.1.0 are affected.** Tho [...]
+ },
+ "affects": [
+ {
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
+ }
+ ]
+ },
+ {
+ "id": "CVE-2025-12183",
+ "source": {
+ "name": "NVD",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12183";
},
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
- "detail": "CVE-2026-8384 is a path-canonicalization flaw in Jetty's
`URIUtil.canonicalPath()`: a semicolon\npath-parameter marker before dot-dot
segments (e.g. `/public;/../admin/secret`) is not normalized,\nso a path-prefix
authorization check can be bypassed. It is exploitable by applications that
use\nJetty's `SecurityHandler.PathMapped`, or that make an authorization
decision on a canonicalized path\nat a **different layer** than the one that
ultimately dispatches the request [...]
+ "detail": "Two issues in the `lz4-java` codec:\n\n* **CVE-2025-12183**
\u2014 several lz4-java compression/decompression implementations do not guard
against\n out-of-bounds memory access (fixed in `lz4-java` 1.8.1).\n*
**CVE-2025-66566** \u2014 decompressor implementations insufficiently clear
their buffers, allowing a\n caller to read leftover contents of a previously
used buffer (fixed in `lz4-java` 1.10.1).\n\nBoth require an application to
drive lz4-java's (de)compression [...]
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
},
{
- "id": "GHSA-mhm7-754m-9p8w",
+ "id": "CVE-2025-66566",
"source": {
- "name": "GITHUB",
- "url": "https://github.com/advisories/GHSA-mhm7-754m-9p8w";
+ "name": "NVD",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66566";
},
"analysis": {
"state": "not_affected",
- "justification": "requires_configuration",
- "detail": "GHSA-mhm7-754m-9p8w is a deserialization-filter bypass in
jackson-databind: a `@JsonView` restriction\ncan be bypassed for creator
properties that use `@JsonTypeInfo(include =
As.EXTERNAL_PROPERTY)`\npolymorphic typing, letting untrusted JSON populate
fields the active view was meant to exclude. It\naffects jackson-databind
2.18.0 \u2013 2.18.8 and 2.21.0 \u2013 2.21.4 (fixed in 2.18.9 / 2.21.5);
the\nexternal-type-id creator path was fixed on the 3.x line and not back [...]
+ "justification": "code_not_reachable",
+ "detail": "Two issues in the `lz4-java` codec:\n\n* **CVE-2025-12183**
\u2014 several lz4-java compression/decompression implementations do not guard
against\n out-of-bounds memory access (fixed in `lz4-java` 1.8.1).\n*
**CVE-2025-66566** \u2014 decompressor implementations insufficiently clear
their buffers, allowing a\n caller to read leftover contents of a previously
used buffer (fixed in `lz4-java` 1.10.1).\n\nBoth require an application to
drive lz4-java's (de)compression [...]
},
"affects": [
{
- "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ "ref": "01ac9322-cd90-5d89-bc71-b848fb531c2a"
}
]
}
diff --git a/output/vex.html b/output/vex.html
index 630f77cb0..0d2f9f43d 100644
--- a/output/vex.html
+++ b/output/vex.html
@@ -142,6 +142,95 @@
<h1>Apache Solr VEX</h1>
<p><a href="/security-dependency-cves.html">← Back to the dependency
CVE table</a></p>
+ <article id="cve-2025-12183" class="post panel radius">
+ <header class="post-header">
+ <h3 class="title"><a
href="https://nvd.nist.gov/vuln/detail/CVE-2025-12183";>CVE-2025-12183</a>, <a
href="https://nvd.nist.gov/vuln/detail/CVE-2025-66566";>CVE-2025-66566</a>,
lz4-java: out-of-bounds memory access and insufficient buffer clearing in
compression/decompression</h3>
+ <div class="panel callout">
+ <p class="subheader">
+ <strong>Published:</strong>
+ <time
datetime="2026-08-13T00:00:00+00:00">2026-08-13</time>
+ </p>
+ <p class="subheader">
+ <strong>Status:</strong>
+ <span class="cdx-not-affected">not_affected</span>
+ </p>
+ <p class="subheader"><strong>Affected Solr
versions:</strong> 9.8.0-10.0.0</p>
+ </div>
+ </header>
+
+ <h4>Description</h4>
+ <p>Two issues in the <code>lz4-java</code> codec:</p>
+<ul>
+<li><strong>CVE-2025-12183</strong> — several lz4-java
compression/decompression implementations do not guard against
+ out-of-bounds memory access (fixed in <code>lz4-java</code> 1.8.1).</li>
+<li><strong>CVE-2025-66566</strong> — decompressor implementations
insufficiently clear their buffers, allowing a
+ caller to read leftover contents of a previously used buffer (fixed in
<code>lz4-java</code> 1.10.1).</li>
+</ul>
+<p>Both require an application to drive lz4-java's (de)compression APIs with
attacker-influenced
+input/buffers.</p>
+<p>Solr is <strong>not affected</strong>. <code>lz4-java</code> is bundled
only by the optional <code>cross-dc</code> module, where it is
+used by the embedded Apache Kafka client for LZ4 compression of
cross-datacenter replication messages.
+Kafka manages its own internal, validated buffers and does not forward
attacker-controlled data into
+the vulnerable code paths, and the replication stream flows through an
operator-controlled Kafka
+pipeline rather than untrusted external input. The <code>cross-dc</code>
module is not part of a default Solr
+installation, and no Solr request path reaches these lz4-java routines.</p>
+<p>Solr shipped an affected <code>org.lz4:lz4-java</code> 1.8.0 from 9.8.0
(when the <code>cross-dc</code> module first bundled
+it) through 10.0.0; releases 9.7.0 and earlier, and the 8.x line, ship no
<code>lz4-java</code>. The fix is
+already on all active development branches: <code>branch_9x</code>,
<code>branch_10x</code>, and <code>main</code> migrated to the
+maintained community fork <code>at.yawk.lz4:lz4-java</code> 1.10.1, which is
past both fixes (1.8.1 and 1.10.1),
+so the next releases (9.11, 10.1) will not be affected. Note this upgrade did
not require Apache Kafka
+to update first — Kafka still declares the old <code>org.lz4:lz4-java</code>,
and Solr replaced that transitive
+dependency with the fork directly.</p>
+
+ <h4>References</h4>
+ <ul>
+ <li>JIRA: <a
href="https://issues.apache.org/jira/browse/SOLR-18013";>SOLR-18013</a></li>
+ <li>CVE: <a
href="https://nvd.nist.gov/vuln/detail/CVE-2025-12183";>CVE-2025-12183</a>, <a
href="https://nvd.nist.gov/vuln/detail/CVE-2025-66566";>CVE-2025-66566</a></li>
+ </ul>
+ </article>
+ <article id="cve-2022-40152" class="post panel radius">
+ <header class="post-header">
+ <h3 class="title"><a
href="https://nvd.nist.gov/vuln/detail/CVE-2022-40152";>CVE-2022-40152</a>,
Woodstox: denial-of-service (stack overflow) parsing untrusted XML when DTD
support is enabled</h3>
+ <div class="panel callout">
+ <p class="subheader">
+ <strong>Published:</strong>
+ <time
datetime="2026-08-11T00:00:00+00:00">2026-08-11</time>
+ </p>
+ <p class="subheader">
+ <strong>Status:</strong>
+ <span class="cdx-exploitable">exploitable</span>
+ </p>
+ <p class="subheader"><strong>Affected Solr
versions:</strong> 9.0.0-9.1.0</p>
+ </div>
+ </header>
+
+ <h4>Description</h4>
+ <p>CVE-2022-40152 (CVSS 6.5) is a denial-of-service issue in
the Woodstox XML parser
+(<code>com.fasterxml.woodstox:woodstox-core</code>): when DTD support is
enabled, a client can supply XML whose
+<code>DOCTYPE</code> internal subset contains a deeply-nested element content
model, causing the parser to
+recurse until it throws a <code>StackOverflowError</code>. It affects
<code>woodstox-core</code> before 5.4.0 and 6.0.0 –
+6.3.x, and is fixed in 5.4.0 and 6.4.0.</p>
+<p>Solr <strong>9.0.0 and 9.1.0 are affected.</strong> Those two releases
shipped <code>woodstox-core</code> 6.2.8 (< 6.4.0), and
+Solr's XML update handler (<code>XMLLoader</code>, serving the untrusted
<code>/update</code> request path) configures its
+StAX input factory via
<code>EmptyEntityResolver.configureXMLInputFactory</code>. That configuration
neutralizes
+external entities — so Solr is <em>not</em> exposed to XXE — but it does
<strong>not</strong> disable DTD processing, so
+the parser still reads the internal DTD subset. A client that POSTs crafted
XML with a deeply-nested
+DTD to <code>/update</code> can therefore reach the vulnerable code and
trigger the stack-overflow DoS. Because
+the vulnerable path is reachable with attacker-controlled input, these
releases are marked
+<code>exploitable</code> rather than <code>not_affected</code>.</p>
+<p><strong>Remediation: upgrade to Apache Solr 9.1.1 or later.</strong> Solr
9.1.1 upgraded to <code>woodstox-core</code> 6.4.0
+(past the fix), and every later release ships a fixed version (6.5.0 in 9.2.0,
7.0.0 in current 9.x,
+7.1.1 in 10.0.0), so no release from 9.1.1 onward is affected. Solr 8.x and
earlier are out of scope
+for this CVE: they used the unrelated
<code>org.codehaus.woodstox:woodstox-core-asl</code> artifact, not
+<code>com.fasterxml.woodstox:woodstox-core</code> (the migration in SOLR-10702
introduced the affected artifact
+at 9.0.0). Solr 9.0.0 and 9.1.0 are both end of life.</p>
+
+ <h4>References</h4>
+ <ul>
+ <li>JIRA: <a
href="https://issues.apache.org/jira/browse/SOLR-10702";>SOLR-10702</a></li>
+ <li>CVE: <a
href="https://nvd.nist.gov/vuln/detail/CVE-2022-40152";>CVE-2022-40152</a></li>
+ </ul>
+ </article>
<article id="ghsa-mhm7-754m-9p8w" class="post panel radius">
<header class="post-header">
<h3 class="title"><a
href="https://github.com/advisories/GHSA-mhm7-754m-9p8w";>GHSA-mhm7-754m-9p8w</a>,
jackson-databind: @JsonView bypass for creator properties with @JsonTypeInfo
external-property polymorphism</h3>
@@ -246,7 +335,7 @@ host-dependent security decision, the host-confusion has no
exploitable conseque
</article>
<article id="cve-2026-59949" class="post panel radius">
<header class="post-header">
- <h3 class="title"><a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-59949";>CVE-2026-59949</a>, <a
href="https://nvd.nist.gov/vuln/detail/CVE-2025-12183";>CVE-2025-12183</a>, <a
href="https://nvd.nist.gov/vuln/detail/CVE-2025-66566";>CVE-2025-66566</a>,
lz4-java: out-of-bounds access and buffer-reuse disclosure in
(de)compression</h3>
+ <h3 class="title"><a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-59949";>CVE-2026-59949</a>,
lz4-java: out-of-bounds read via invalid arguments to native XXHash</h3>
<div class="panel callout">
<p class="subheader">
<strong>Published:</strong>
@@ -261,34 +350,29 @@ host-dependent security decision, the host-confusion has
no exploitable conseque
</header>
<h4>Description</h4>
- <p>Three issues in the <code>at.yawk.lz4:lz4-java</code> codec
(the community-maintained fork of the discontinued
-lz4-java):</p>
-<ul>
-<li><strong>CVE-2026-59949</strong> (CVSS 6.5) — out-of-bounds read: the
JNI-based XXHash implementations don't
- validate their byte-array arguments, so a caller passing an invalid array
reference or out-of-range
- <code>off</code>/<code>len</code> can crash the JVM (fixed in 1.11.1).</li>
-<li><strong>CVE-2025-12183</strong> — out-of-bounds memory access in the
compression/decompression functions,
- leading to denial of service and possible information disclosure when
processing untrusted input
- (fixed in 1.8.1).</li>
-<li><strong>CVE-2025-66566</strong> — the Java decompressor does not clear
reused output buffers, so crafted
- compressed input can read previous buffer contents when an output buffer is
reused (fixed in
- 1.10.1).</li>
-</ul>
-<p>All three affect the <code>lz4-java</code> 1.8.0 that Solr's released 9.8.0
– 10.0.0 line bundles (SOLR-18013
-tracks the upgrade to 1.10.1). Each is reachable only when an application
feeds attacker-controlled
-input to the codec, or passes attacker-influenced arguments into it.</p>
-<p>Solr is <strong>not affected</strong>. <code>lz4-java</code> is bundled
only by the optional <code>cross-dc</code> module, where the
-embedded Apache Kafka client uses it to (de)compress and checksum
cross-datacenter replication
-messages. Those messages flow through an <strong>operator-controlled</strong>
Kafka pipeline (Solr's own cross-DC
-producer → the operator's Kafka → Solr's consumer), not untrusted external
input, and Kafka calls the
-codec with its own internally-managed, validated buffers and offsets rather
than forwarding
-attacker-controlled arguments. The <code>cross-dc</code> module is not part of
a default Solr installation, and
-no Solr request path reaches the vulnerable compression/decompression or
XXHash code.</p>
+ <p>CVE-2026-59949 (CVSS 6.5) is an out-of-bounds read in the
<code>lz4-java</code> codec: the JNI-based XXHash
+implementations insufficiently validate their byte-array arguments, so a
caller that passes an
+invalid array reference or an out-of-range <code>off</code>/<code>len</code>
to the native XXHash methods can crash the JVM.
+It affects <code>lz4-java</code> ≤ 1.11.0 (fixed in 1.11.1). Exploitation
requires an application to pass
+attacker-influenced array/offset/length values into those XXHash APIs.</p>
+<p>Solr is <strong>not affected</strong>. <code>lz4-java</code> is bundled
only by the optional <code>cross-dc</code> module, where it is
+used by the embedded Apache Kafka client for LZ4 compression / checksums of
cross-datacenter
+replication messages. Kafka calls the XXHash APIs with its own
internally-managed, validated buffers
+and offsets — it does not forward attacker-controlled
<code>off</code>/<code>len</code> values into the native methods — and
+the replication stream flows through an operator-controlled Kafka pipeline,
not untrusted external
+input. The <code>cross-dc</code> module is not part of a default Solr
installation, and no Solr request path
+reaches the vulnerable XXHash argument handling.</p>
+<p>Solr shipped an affected <code>org.lz4:lz4-java</code> 1.8.0 from 9.8.0
(when the <code>cross-dc</code> module first bundled
+it) through 10.0.0. Unlike CVE-2025-12183 / CVE-2025-66566 (covered separately
and fixed by the
+<code>branch_9x</code> / <code>branch_10x</code> / <code>main</code> migration
to the fork <code>at.yawk.lz4:lz4-java</code> 1.10.1), <strong>this issue
+is not yet fixed on any branch</strong>: 1.11.1 is required, and all three
development branches are on 1.10.1,
+so the upcoming 9.11 and 10.1 releases will still bundle an affected version.
The affected Solr range
+will need to extend to those releases once they ship.</p>
<h4>References</h4>
<ul>
<li>JIRA: <a
href="https://issues.apache.org/jira/browse/SOLR-18013";>SOLR-18013</a></li>
- <li>CVE: <a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-59949";>CVE-2026-59949</a>, <a
href="https://nvd.nist.gov/vuln/detail/CVE-2025-12183";>CVE-2025-12183</a>, <a
href="https://nvd.nist.gov/vuln/detail/CVE-2025-66566";>CVE-2025-66566</a></li>
+ <li>CVE: <a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-59949";>CVE-2026-59949</a></li>
</ul>
</article>
<article id="cve-2026-59899" class="post panel radius">
