This is an automated email from the ASF dual-hosted git repository.
github-actions[bot] pushed a commit to branch asf-staging
in repository https://gitbox.apache.org/repos/asf/solr-site.git
The following commit(s) were added to refs/heads/asf-staging by this push:
new a851b5390 Commit build products
a851b5390 is described below
commit a851b53908cd6c8a0e83dac15389deae1f54dcd8
Author: Build Pelican (action) <[email protected]>
AuthorDate: Thu Aug 13 13:52:34 2026 +0000
Commit build products
---
output/feeds/all.atom.xml | 103 ++++++----
output/feeds/solr/vex.atom.xml | 74 +++++--
output/security-dependency-cves.html | 17 +-
output/solr.openvex.json | 81 +++++++-
output/solr.vex.json | 383 +++++++++++++++++++++--------------
output/vex.html | 94 +++++++--
6 files changed, 521 insertions(+), 231 deletions(-)
diff --git a/output/feeds/all.atom.xml b/output/feeds/all.atom.xml
index eb35e4164..85f4dc42e 100644
--- a/output/feeds/all.atom.xml
+++ b/output/feeds/all.atom.xml
@@ -257,21 +257,34 @@ Netty &lt; 4.1.136 and 4.2.0–4.2.15, fixed in 4.1.136
/ 4.2.16):</p>
<p>Solr is <strong>not affected</strong>. Solr bundles Netty
only via the optional OpenTelemetry (OTLP) exporter and
the ZooKeeper client, where Netty is used strictly as a
<strong>client</strong>. Solr's HTTP server is Jetty:
Solr never runs a Netty HTTP server, CORS handler, WebSocket server, or
HTTP/2→1 proxy, and never
-uses Netty's multipart request encoder, so none of these code paths are
reachable.</p></content><category
term="solr/vex"/></entry><entry><title>lz4-java: out-of-bounds read via invalid
arguments to native XXHash</title><link href="/cve-2026-59949.html"
rel="alternate"/><published>2026-07-31T00:00:00+00:00</published><updated>2026-07-31T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-07-31:/cve-2026-59949.html</id><summary
type="html"><p> [...]
-JNI-based XXHash implementations insufficiently validate their byte-array
arguments, so a caller that
-passes an invalid array reference or an out-of-range
<code>off</code>/<code>len</code> to the native XXHash
methods can
-crash the JVM. It affects lz4-java …</p></summary><content
type="html"><p>CVE-2026-59949 (CVSS 6.5) is an out-of-bounds read in the
<code>at.yawk.lz4:lz4-java</code> codec: the
-JNI-based XXHash implementations insufficiently validate their byte-array
arguments, so a caller that
-passes an invalid array reference or an out-of-range
<code>off</code>/<code>len</code> to the native XXHash
methods can
-crash the JVM. It affects lz4-java ≤ 1.11.0 (fixed in 1.11.1). Exploitation
requires an application
-to pass attacker-influenced array/offset/length values into those XXHash
APIs.</p>
-<p>Solr is <strong>not affected</strong>.
<code>lz4-java</code> is bundled only by the optional
<code>cross-dc</code> module, where it is
-used by the embedded Apache Kafka client for LZ4 compression / checksums of
cross-datacenter
-replication messages. Kafka calls the XXHash APIs with its own
internally-managed, validated buffers
-and offsets — it does not forward attacker-controlled
<code>off</code>/<code>len</code> values into the
native methods —
-and the replication stream flows through an operator-controlled Kafka
pipeline, not untrusted
-external input. The <code>cross-dc</code> module is not part of a
default Solr installation, and no Solr request
-path reaches the vulnerable XXHash argument
handling.</p></content><category
term="solr/vex"/></entry><entry><title>Eclipse Jetty: HTTP/2 :authority vs Host
header confusion</title><link href="/cve-2026-6790.html"
rel="alternate"/><published>2026-07-31T00:00:00+00:00</published><updated>2026-07-31T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-07-31:/cve-2026-6790.html</id><summary
type="html"><p>CVE-2026-6790 is an input-validation gap [...]
+uses Netty's multipart request encoder, so none of these code paths are
reachable.</p></content><category
term="solr/vex"/></entry><entry><title>lz4-java: out-of-bounds access and
buffer-reuse disclosure in (de)compression</title><link
href="/cve-2026-59949.html"
rel="alternate"/><published>2026-07-31T00:00:00+00:00</published><updated>2026-07-31T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-07-31:/cve-2026-59949.html</id><summary
type="html [...]
+lz4-java):</p>
+<ul>
+<li><strong>CVE-2026-59949</strong> (CVSS 6.5) —
out-of-bounds read: the JNI-based XXHash implementations don't
+ validate their byte-array arguments, so a caller passing an invalid array
reference or out-of-range
+ <code>off</code>/<code>len</code> can crash the JVM
(fixed in 1 …</li></ul></summary><content
type="html"><p>Three issues in the
<code>at.yawk.lz4:lz4-java</code> codec (the community-maintained
fork of the discontinued
+lz4-java):</p>
+<ul>
+<li><strong>CVE-2026-59949</strong> (CVSS 6.5) —
out-of-bounds read: the JNI-based XXHash implementations don't
+ validate their byte-array arguments, so a caller passing an invalid array
reference or out-of-range
+ <code>off</code>/<code>len</code> can crash the JVM
(fixed in 1.11.1).</li>
+<li><strong>CVE-2025-12183</strong> — out-of-bounds memory
access in the compression/decompression functions,
+ leading to denial of service and possible information disclosure when
processing untrusted input
+ (fixed in 1.8.1).</li>
+<li><strong>CVE-2025-66566</strong> — the Java decompressor
does not clear reused output buffers, so crafted
+ compressed input can read previous buffer contents when an output buffer is
reused (fixed in
+ 1.10.1).</li>
+</ul>
+<p>All three affect the <code>lz4-java</code> 1.8.0 that
Solr's released 9.8.0 – 10.0.0 line bundles (SOLR-18013
+tracks the upgrade to 1.10.1). Each is reachable only when an application
feeds attacker-controlled
+input to the codec, or passes attacker-influenced arguments into it.</p>
+<p>Solr is <strong>not affected</strong>.
<code>lz4-java</code> is bundled only by the optional
<code>cross-dc</code> module, where the
+embedded Apache Kafka client uses it to (de)compress and checksum
cross-datacenter replication
+messages. Those messages flow through an
<strong>operator-controlled</strong> Kafka pipeline (Solr's own
cross-DC
+producer → the operator's Kafka → Solr's consumer), not untrusted external
input, and Kafka calls the
+codec with its own internally-managed, validated buffers and offsets rather
than forwarding
+attacker-controlled arguments. The <code>cross-dc</code> module is
not part of a default Solr installation, and
+no Solr request path reaches the vulnerable compression/decompression or
XXHash code.</p></content><category
term="solr/vex"/></entry><entry><title>Eclipse Jetty: HTTP/2 :authority vs Host
header confusion</title><link href="/cve-2026-6790.html"
rel="alternate"/><published>2026-07-31T00:00:00+00:00</published><updated>2026-07-31T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-07-31:/cve-2026-6790.html</id><summary
type="html"><p>CVE-2026 [...]
does not require the <code>:authority</code> pseudo-header to
match the <code>Host</code> header, so a single request can
carry two conflicting host interpretations. It affects the Jetty branches Solr
ships (9.4.x, 10.0.x
through …</p></summary><content type="html"><p>CVE-2026-6790 is an
input-validation gap in Jetty's HTTP/2 (and HTTP/3) request processing: Jetty
@@ -1587,7 +1600,36 @@ line to <code>libthrift</code> 0.14.1 (past
the 0.14.0 fix), and Sol
so no 8.11.1+, 9.x, or 10.x release is affected. (The Solr 8.x line is end of
life.) Note that
SOLR-15507 — which proposed the upgrade and observed that Solr 8.9.0 still
bundled <code>libthrift</code> 0.13.0 —
remains open with no fix version, but the upgrade was in fact delivered in
8.11.1 (verified against the
-<code>solr:8.11.0</code> and <code>solr:8.11.1</code>
release images).</p></content><category
term="solr/vex"/></entry><entry><title>Bouncy Castle (bcprov): LDAP CertStore
injection, EC/Ed25519 DoS, and RSA/TLS timing side-channel</title><link
href="/cve-2023-33201.html"
rel="alternate"/><published>2025-09-07T00:00:00+00:00</published><updated>2025-09-07T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2025-09-07:/cve-2023-33 [...]
+<code>solr:8.11.0</code> and <code>solr:8.11.1</code>
release images).</p></content><category
term="solr/vex"/></entry><entry><title>jQuery UI (Admin UI): XSS in datepicker
and position widgets</title><link href="/cve-2021-41182.html"
rel="alternate"/><published>2025-09-07T00:00:00+00:00</published><updated>2025-09-07T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2025-09-07:/cve-2021-41182.html</id><summary
type="html">< [...]
+<ul>
+<li><strong>CVE-2021-41182</strong> — XSS via the datepicker
<code>altField</code> option.</li>
+<li><strong>CVE-2021-41183</strong> — XSS via the datepicker
<code>*Text</code> options.</li>
+<li><strong>CVE-2021-41184</strong> — XSS via the
<code>.position()</code> <code>of</code>
option.</li>
+</ul>
+<p>Solr's Admin UI bundles a <strong>custom subset</strong>
of jQuery UI (<code>server/solr-webapp/webapp/libs
…</code></p></summary><content type="html"><p>Three XSS
issues in jQuery UI 1.12.1 (all fixed in 1.13.x):</p>
+<ul>
+<li><strong>CVE-2021-41182</strong> — XSS via the datepicker
<code>altField</code> option.</li>
+<li><strong>CVE-2021-41183</strong> — XSS via the datepicker
<code>*Text</code> options.</li>
+<li><strong>CVE-2021-41184</strong> — XSS via the
<code>.position()</code> <code>of</code>
option.</li>
+</ul>
+<p>Solr's Admin UI bundles a <strong>custom subset</strong>
of jQuery UI
(<code>server/solr-webapp/webapp/libs/jquery-ui.min.js</code>,
+v1.12.1) from Solr 7.5.0 through 10.0.0. Solr is <strong>not
affected</strong>:</p>
+<ul>
+<li><strong>The datepicker widget is not included.</strong>
Solr's build excludes datepicker entirely (it is absent
+ from the shipped <code>jquery-ui.min.js</code>), so
CVE-2021-41182 and CVE-2021-41183 — both datepicker-only —
+ have no code present to exploit.</li>
+<li><strong>The position utility is included, but not reachable
with attacker input.</strong> CVE-2021-41184
+ requires passing attacker-controlled markup to the
<code>of</code> option of <code>.position()</code>.
Solr's Admin UI
+ invokes positioning (for tooltips/dialogs) only with its own static, trusted
selectors, never with
+ externally-supplied values. The Admin UI is also an operator-facing console,
not an
+ unauthenticated public surface.</li>
+</ul>
+<blockquote>
+<p>Note: this is a <strong>front-end JavaScript</strong>
dependency, not a Maven artifact. This entry documents
+Solr's assessment for the record; unlike the Java-jar entries it does not emit
a matchable Maven
+purl, and Docker Scout does not flag the bundled minified JS. It corresponds
to SOLR-16309, whose
+reporter likewise characterized it as a compliance finding rather than an
exploitable risk.</p>
+</blockquote></content><category
term="solr/vex"/></entry><entry><title>Bouncy Castle (bcprov): LDAP CertStore
injection, EC/Ed25519 DoS, and RSA/TLS timing side-channel</title><link
href="/cve-2023-33201.html"
rel="alternate"/><published>2025-09-07T00:00:00+00:00</published><updated>2025-09-07T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2025-09-07:/cve-2023-33201.html</id><summary
type="html"><p>Four vulnerabilities in the Bouncy Castle [...]
each in a distinct crypto operation:</p>
<ul>
<li><strong>CVE-2023-33201</strong> — LDAP injection in the
X.509 <code>CertStore</code> (fixed in 1.74); requires using Bouncy
@@ -2338,31 +2380,4 @@ JIRA - <a
href="https://issues.apache.org/jira/browse/SOLR-16808">SOLR-152
CVE - <a
href="https://nvd.nist.gov/vuln/detail/CVE-2023-50290">CVE-2023-50290</a></p></content><category
term="solr/security"/></entry><entry><title>json-path</title><link
href="/cve-2023-51074.html"
rel="alternate"/><published>2024-01-12T00:00:00+00:00</published><updated>2024-01-12T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2024-01-12:/cve-2023-51074.html</id><summary
type="html"><p>The only places we use json-path is for [...]
<p>CVE-2023-51074 affects json-path 2.2.0 through 2.8.0 (fixed in
2.9.0). Solr first bundled json-path
in Solr 8.1.0 (2.4.0) and shipped an affected version — 2.4.0, then 2.7.0,
then 2.8.0 — through Solr
-9.5.0; Solr 9.6.0 upgraded to the fixed 2.9.0. The affected range is therefore
8.1.0 – 9.5.0.</p></content><category
term="solr/vex"/></entry><entry><title>Apache Solr Operator™ v0.8.0
available</title><link href="/apache-solr-operatortm-v080-available.html"
rel="alternate"/><published>2023-10-20T00:00:00+00:00</published><updated>2023-10-20T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2023-10-20:/apache-solr-operatortm-v080-available.html</id><
[...]
-<p>The Apache Solr Operator is a safe and easy way of managing a Solr
ecosystem in Kubernetes.</p>
-<p>This release contains numerous bug fixes, optimizations, and
improvements, some of which are highlighted below …</p></summary><content
type="html"><p>The Apache Solr PMC is pleased to announce the release of
the Apache Solr Operator v0.8.0.</p>
-<p>The Apache Solr Operator is a safe and easy way of managing a Solr
ecosystem in Kubernetes.</p>
-<p>This release contains numerous bug fixes, optimizations, and
improvements, some of which are highlighted below. The release is available for
immediate download at:</p>
-<p><a
href="https://solr.apache.org/operator/artifacts.html">https://solr.apache.org/operator/artifacts.html</a></p>
-<h3 id="solr-operator-v080-release-highlights">Solr Operator v0.8.0
Release Highlights:<a class="headerlink"
href="#solr-operator-v080-release-highlights" title="Permanent
link">&para;</a></h3>
-<ul>
-<li>The minimum supported version of Solr has been set to Solr
8.11</li>
-<li>The minimum Kubernetes version supported is now v1.22</li>
-<li>Managed scale up and scale down are now supported for
SolrClouds.<ul>
-<li>By default, when scaling down a SolrCloud, replicas will be migrated
off Pods before they are deleted.</li>
-<li>By default, when scaling up a SolrCloud, replicas will be balanced
across all Pods after the SolrCloud has been scaled up. (Only supported for
Solr 9.3+)</li>
-</ul>
-</li>
-<li>SSL bugs with Solr 9 have been fixed, and v0.8.0 will successfully
support SSL for Solr 8.11 and 9.4+</li>
-<li>Solr 8.11 features are now supported by default, such as
maxBooleanClauses, metrics disabling, health endpoint for
readinessCheck</li>
-<li>Keystore/Truststore passwords can be explicitly set in the SolrCloud
CRD for mountedDir SSL. This enables the use of the CertManager CSI Driver with
Solr.</li>
-<li>Rolling Updates for SolrClouds using ephemeral storage are now safer
and replicas are balanced at the end of the operation to ensure optimal
resource utilization.<ul>
-<li>Replica balancing is only supported when Solr 9.3+ is
used.</li>
-</ul>
-</li>
-</ul>
-<p>A summary of important changes is published in the documentation
at:</p>
-<p><a
href="https://solr.apache.org/guide/operator/latest/upgrade-notes/upgrade-notes.html">https://solr.apache.org/guide/operator/latest/upgrade-notes/upgrade-notes.html</a></p>
-<p>For the most exhaustive list, see the change log on ArtifactHub or
view the git history in the solr-operator repo.</p>
-<p><a
href="https://artifacthub.io/packages/helm/apache-solr/solr-operator?modal=changelog">https://artifacthub.io/packages/helm/apache-solr/solr-operator?modal=changelog</a></p>
-<p><a
href="https://github.com/apache/solr-operator/releases/tag/v0.8.0">https://github.com/apache/solr-operator/releases/tag/v0.8.0</a></p></content><category
term="solr/operator/news"/></entry></feed>
\ No newline at end of file
+9.5.0; Solr 9.6.0 upgraded to the fixed 2.9.0. The affected range is therefore
8.1.0 – 9.5.0.</p></content><category term="solr/vex"/></entry></feed>
\ No newline at end of file
diff --git a/output/feeds/solr/vex.atom.xml b/output/feeds/solr/vex.atom.xml
index c8669b4c1..8e8c3d5ea 100644
--- a/output/feeds/solr/vex.atom.xml
+++ b/output/feeds/solr/vex.atom.xml
@@ -257,21 +257,34 @@ Netty &lt; 4.1.136 and 4.2.0–4.2.15, fixed in 4.1.136
/ 4.2.16):</p>
<p>Solr is <strong>not affected</strong>. Solr bundles Netty
only via the optional OpenTelemetry (OTLP) exporter and
the ZooKeeper client, where Netty is used strictly as a
<strong>client</strong>. Solr's HTTP server is Jetty:
Solr never runs a Netty HTTP server, CORS handler, WebSocket server, or
HTTP/2→1 proxy, and never
-uses Netty's multipart request encoder, so none of these code paths are
reachable.</p></content><category
term="solr/vex"/></entry><entry><title>lz4-java: out-of-bounds read via invalid
arguments to native XXHash</title><link href="/cve-2026-59949.html"
rel="alternate"/><published>2026-07-31T00:00:00+00:00</published><updated>2026-07-31T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-07-31:/cve-2026-59949.html</id><summary
type="html"><p> [...]
-JNI-based XXHash implementations insufficiently validate their byte-array
arguments, so a caller that
-passes an invalid array reference or an out-of-range
<code>off</code>/<code>len</code> to the native XXHash
methods can
-crash the JVM. It affects lz4-java …</p></summary><content
type="html"><p>CVE-2026-59949 (CVSS 6.5) is an out-of-bounds read in the
<code>at.yawk.lz4:lz4-java</code> codec: the
-JNI-based XXHash implementations insufficiently validate their byte-array
arguments, so a caller that
-passes an invalid array reference or an out-of-range
<code>off</code>/<code>len</code> to the native XXHash
methods can
-crash the JVM. It affects lz4-java ≤ 1.11.0 (fixed in 1.11.1). Exploitation
requires an application
-to pass attacker-influenced array/offset/length values into those XXHash
APIs.</p>
-<p>Solr is <strong>not affected</strong>.
<code>lz4-java</code> is bundled only by the optional
<code>cross-dc</code> module, where it is
-used by the embedded Apache Kafka client for LZ4 compression / checksums of
cross-datacenter
-replication messages. Kafka calls the XXHash APIs with its own
internally-managed, validated buffers
-and offsets — it does not forward attacker-controlled
<code>off</code>/<code>len</code> values into the
native methods —
-and the replication stream flows through an operator-controlled Kafka
pipeline, not untrusted
-external input. The <code>cross-dc</code> module is not part of a
default Solr installation, and no Solr request
-path reaches the vulnerable XXHash argument
handling.</p></content><category
term="solr/vex"/></entry><entry><title>Eclipse Jetty: HTTP/2 :authority vs Host
header confusion</title><link href="/cve-2026-6790.html"
rel="alternate"/><published>2026-07-31T00:00:00+00:00</published><updated>2026-07-31T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-07-31:/cve-2026-6790.html</id><summary
type="html"><p>CVE-2026-6790 is an input-validation gap [...]
+uses Netty's multipart request encoder, so none of these code paths are
reachable.</p></content><category
term="solr/vex"/></entry><entry><title>lz4-java: out-of-bounds access and
buffer-reuse disclosure in (de)compression</title><link
href="/cve-2026-59949.html"
rel="alternate"/><published>2026-07-31T00:00:00+00:00</published><updated>2026-07-31T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-07-31:/cve-2026-59949.html</id><summary
type="html [...]
+lz4-java):</p>
+<ul>
+<li><strong>CVE-2026-59949</strong> (CVSS 6.5) —
out-of-bounds read: the JNI-based XXHash implementations don't
+ validate their byte-array arguments, so a caller passing an invalid array
reference or out-of-range
+ <code>off</code>/<code>len</code> can crash the JVM
(fixed in 1 …</li></ul></summary><content
type="html"><p>Three issues in the
<code>at.yawk.lz4:lz4-java</code> codec (the community-maintained
fork of the discontinued
+lz4-java):</p>
+<ul>
+<li><strong>CVE-2026-59949</strong> (CVSS 6.5) —
out-of-bounds read: the JNI-based XXHash implementations don't
+ validate their byte-array arguments, so a caller passing an invalid array
reference or out-of-range
+ <code>off</code>/<code>len</code> can crash the JVM
(fixed in 1.11.1).</li>
+<li><strong>CVE-2025-12183</strong> — out-of-bounds memory
access in the compression/decompression functions,
+ leading to denial of service and possible information disclosure when
processing untrusted input
+ (fixed in 1.8.1).</li>
+<li><strong>CVE-2025-66566</strong> — the Java decompressor
does not clear reused output buffers, so crafted
+ compressed input can read previous buffer contents when an output buffer is
reused (fixed in
+ 1.10.1).</li>
+</ul>
+<p>All three affect the <code>lz4-java</code> 1.8.0 that
Solr's released 9.8.0 – 10.0.0 line bundles (SOLR-18013
+tracks the upgrade to 1.10.1). Each is reachable only when an application
feeds attacker-controlled
+input to the codec, or passes attacker-influenced arguments into it.</p>
+<p>Solr is <strong>not affected</strong>.
<code>lz4-java</code> is bundled only by the optional
<code>cross-dc</code> module, where the
+embedded Apache Kafka client uses it to (de)compress and checksum
cross-datacenter replication
+messages. Those messages flow through an
<strong>operator-controlled</strong> Kafka pipeline (Solr's own
cross-DC
+producer → the operator's Kafka → Solr's consumer), not untrusted external
input, and Kafka calls the
+codec with its own internally-managed, validated buffers and offsets rather
than forwarding
+attacker-controlled arguments. The <code>cross-dc</code> module is
not part of a default Solr installation, and
+no Solr request path reaches the vulnerable compression/decompression or
XXHash code.</p></content><category
term="solr/vex"/></entry><entry><title>Eclipse Jetty: HTTP/2 :authority vs Host
header confusion</title><link href="/cve-2026-6790.html"
rel="alternate"/><published>2026-07-31T00:00:00+00:00</published><updated>2026-07-31T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-07-31:/cve-2026-6790.html</id><summary
type="html"><p>CVE-2026 [...]
does not require the <code>:authority</code> pseudo-header to
match the <code>Host</code> header, so a single request can
carry two conflicting host interpretations. It affects the Jetty branches Solr
ships (9.4.x, 10.0.x
through …</p></summary><content type="html"><p>CVE-2026-6790 is an
input-validation gap in Jetty's HTTP/2 (and HTTP/3) request processing: Jetty
@@ -1355,7 +1368,36 @@ line to <code>libthrift</code> 0.14.1 (past
the 0.14.0 fix), and Sol
so no 8.11.1+, 9.x, or 10.x release is affected. (The Solr 8.x line is end of
life.) Note that
SOLR-15507 — which proposed the upgrade and observed that Solr 8.9.0 still
bundled <code>libthrift</code> 0.13.0 —
remains open with no fix version, but the upgrade was in fact delivered in
8.11.1 (verified against the
-<code>solr:8.11.0</code> and <code>solr:8.11.1</code>
release images).</p></content><category
term="solr/vex"/></entry><entry><title>Bouncy Castle (bcprov): LDAP CertStore
injection, EC/Ed25519 DoS, and RSA/TLS timing side-channel</title><link
href="/cve-2023-33201.html"
rel="alternate"/><published>2025-09-07T00:00:00+00:00</published><updated>2025-09-07T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2025-09-07:/cve-2023-33 [...]
+<code>solr:8.11.0</code> and <code>solr:8.11.1</code>
release images).</p></content><category
term="solr/vex"/></entry><entry><title>jQuery UI (Admin UI): XSS in datepicker
and position widgets</title><link href="/cve-2021-41182.html"
rel="alternate"/><published>2025-09-07T00:00:00+00:00</published><updated>2025-09-07T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2025-09-07:/cve-2021-41182.html</id><summary
type="html">< [...]
+<ul>
+<li><strong>CVE-2021-41182</strong> — XSS via the datepicker
<code>altField</code> option.</li>
+<li><strong>CVE-2021-41183</strong> — XSS via the datepicker
<code>*Text</code> options.</li>
+<li><strong>CVE-2021-41184</strong> — XSS via the
<code>.position()</code> <code>of</code>
option.</li>
+</ul>
+<p>Solr's Admin UI bundles a <strong>custom subset</strong>
of jQuery UI (<code>server/solr-webapp/webapp/libs
…</code></p></summary><content type="html"><p>Three XSS
issues in jQuery UI 1.12.1 (all fixed in 1.13.x):</p>
+<ul>
+<li><strong>CVE-2021-41182</strong> — XSS via the datepicker
<code>altField</code> option.</li>
+<li><strong>CVE-2021-41183</strong> — XSS via the datepicker
<code>*Text</code> options.</li>
+<li><strong>CVE-2021-41184</strong> — XSS via the
<code>.position()</code> <code>of</code>
option.</li>
+</ul>
+<p>Solr's Admin UI bundles a <strong>custom subset</strong>
of jQuery UI
(<code>server/solr-webapp/webapp/libs/jquery-ui.min.js</code>,
+v1.12.1) from Solr 7.5.0 through 10.0.0. Solr is <strong>not
affected</strong>:</p>
+<ul>
+<li><strong>The datepicker widget is not included.</strong>
Solr's build excludes datepicker entirely (it is absent
+ from the shipped <code>jquery-ui.min.js</code>), so
CVE-2021-41182 and CVE-2021-41183 — both datepicker-only —
+ have no code present to exploit.</li>
+<li><strong>The position utility is included, but not reachable
with attacker input.</strong> CVE-2021-41184
+ requires passing attacker-controlled markup to the
<code>of</code> option of <code>.position()</code>.
Solr's Admin UI
+ invokes positioning (for tooltips/dialogs) only with its own static, trusted
selectors, never with
+ externally-supplied values. The Admin UI is also an operator-facing console,
not an
+ unauthenticated public surface.</li>
+</ul>
+<blockquote>
+<p>Note: this is a <strong>front-end JavaScript</strong>
dependency, not a Maven artifact. This entry documents
+Solr's assessment for the record; unlike the Java-jar entries it does not emit
a matchable Maven
+purl, and Docker Scout does not flag the bundled minified JS. It corresponds
to SOLR-16309, whose
+reporter likewise characterized it as a compliance finding rather than an
exploitable risk.</p>
+</blockquote></content><category
term="solr/vex"/></entry><entry><title>Bouncy Castle (bcprov): LDAP CertStore
injection, EC/Ed25519 DoS, and RSA/TLS timing side-channel</title><link
href="/cve-2023-33201.html"
rel="alternate"/><published>2025-09-07T00:00:00+00:00</published><updated>2025-09-07T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2025-09-07:/cve-2023-33201.html</id><summary
type="html"><p>Four vulnerabilities in the Bouncy Castle [...]
each in a distinct crypto operation:</p>
<ul>
<li><strong>CVE-2023-33201</strong> — LDAP injection in the
X.509 <code>CertStore</code> (fixed in 1.74); requires using Bouncy
diff --git a/output/security-dependency-cves.html
b/output/security-dependency-cves.html
index 096140c94..8667d5460 100644
--- a/output/security-dependency-cves.html
+++ b/output/security-dependency-cves.html
@@ -218,12 +218,12 @@ or contact <a
href="mailto:[email protected]";>[email protected]</a>.</p>
</tr>
<tr>
<td>
-<a href="https://nvd.nist.gov/vuln/detail/CVE-2026-59949";>CVE-2026-59949</a>
</td>
- <td>9.0.0-10.0.0</td>
+<a href="https://nvd.nist.gov/vuln/detail/CVE-2026-59949";>CVE-2026-59949</a>,
<a href="https://nvd.nist.gov/vuln/detail/CVE-2025-12183";>CVE-2025-12183</a>,
<a href="https://nvd.nist.gov/vuln/detail/CVE-2025-66566";>CVE-2025-66566</a>
</td>
+ <td>9.8.0-10.0.0</td>
<td>
- lz4-java-1.10.1.jar </td>
+ lz4-java-1.8.0.jar </td>
<td><span class="cdx-not-affected">not affected</span></td>
- <td><a href="/vex.html#cve-2026-59949">lz4-java: out-of-bounds read via
invalid arguments to native XXHash</a></td>
+ <td><a href="/vex.html#cve-2026-59949">lz4-java: out-of-bounds access
and buffer-reuse disclosure in (de)compression</a></td>
</tr>
<tr>
<td>
@@ -731,6 +731,15 @@ or contact <a
href="mailto:[email protected]";>[email protected]</a>.</p>
</tr>
<tr>
<td>
+<a href="https://nvd.nist.gov/vuln/detail/CVE-2021-41182";>CVE-2021-41182</a>,
<a href="https://nvd.nist.gov/vuln/detail/CVE-2021-41183";>CVE-2021-41183</a>,
<a href="https://nvd.nist.gov/vuln/detail/CVE-2021-41184";>CVE-2021-41184</a>
</td>
+ <td>7.5.0-10.0.0</td>
+ <td>
+ jquery-ui-1.12.1.js </td>
+ <td><span class="cdx-not-affected">not affected</span></td>
+ <td><a href="/vex.html#cve-2021-41182">jQuery UI (Admin UI): XSS in
datepicker and position widgets</a></td>
+ </tr>
+ <tr>
+ <td>
<a href="https://nvd.nist.gov/vuln/detail/CVE-2020-13949";>CVE-2020-13949</a>
</td>
<td>8.2.0-8.11.0</td>
<td>
diff --git a/output/solr.openvex.json b/output/solr.openvex.json
index 342e69039..8ed0cc85f 100644
--- a/output/solr.openvex.json
+++ b/output/solr.openvex.json
@@ -1511,6 +1511,51 @@
"impact_statement": "CVE-2020-13949 is a denial-of-service issue in
Apache Thrift: a malicious RPC **client** can send\nspecially-crafted short
messages that cause a Thrift **server** to allocate a large amount of
memory,\npotentially exhausting it (affects `libthrift` 0.9.3 \u2013 0.13.0,
fixed in 0.14.0). It is reachable only\nby an application that runs a Thrift
server accepting messages from untrusted clients.\n\nSolr is **not affected**.
`libthrift` is bundled only by the opti [...]
"status_notes": "Affected Apache Solr versions: 8.2.0-8.11.0."
},
+ {
+ "vulnerability": {
+ "name": "CVE-2021-41182"
+ },
+ "products": [
+ {
+ "@id": "jquery-ui-1.12.1.js"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2025-09-07T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "Three XSS issues in jQuery UI 1.12.1 (all fixed in
1.13.x):\n\n* **CVE-2021-41182** \u2014 XSS via the datepicker `altField`
option.\n* **CVE-2021-41183** \u2014 XSS via the datepicker `*Text` options.\n*
**CVE-2021-41184** \u2014 XSS via the `.position()` `of` option.\n\nSolr's
Admin UI bundles a **custom subset** of jQuery UI
(`server/solr-webapp/webapp/libs/jquery-ui.min.js`,\nv1.12.1) from Solr 7.5.0
through 10.0.0. Solr is **not affected**:\n\n* **The date [...]
+ "status_notes": "Affected Apache Solr versions: 7.5.0-10.0.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2021-41183"
+ },
+ "products": [
+ {
+ "@id": "jquery-ui-1.12.1.js"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2025-09-07T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "Three XSS issues in jQuery UI 1.12.1 (all fixed in
1.13.x):\n\n* **CVE-2021-41182** \u2014 XSS via the datepicker `altField`
option.\n* **CVE-2021-41183** \u2014 XSS via the datepicker `*Text` options.\n*
**CVE-2021-41184** \u2014 XSS via the `.position()` `of` option.\n\nSolr's
Admin UI bundles a **custom subset** of jQuery UI
(`server/solr-webapp/webapp/libs/jquery-ui.min.js`,\nv1.12.1) from Solr 7.5.0
through 10.0.0. Solr is **not affected**:\n\n* **The date [...]
+ "status_notes": "Affected Apache Solr versions: 7.5.0-10.0.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2021-41184"
+ },
+ "products": [
+ {
+ "@id": "jquery-ui-1.12.1.js"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2025-09-07T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "Three XSS issues in jQuery UI 1.12.1 (all fixed in
1.13.x):\n\n* **CVE-2021-41182** \u2014 XSS via the datepicker `altField`
option.\n* **CVE-2021-41183** \u2014 XSS via the datepicker `*Text` options.\n*
**CVE-2021-41184** \u2014 XSS via the `.position()` `of` option.\n\nSolr's
Admin UI bundles a **custom subset** of jQuery UI
(`server/solr-webapp/webapp/libs/jquery-ui.min.js`,\nv1.12.1) from Solr 7.5.0
through 10.0.0. Solr is **not affected**:\n\n* **The date [...]
+ "status_notes": "Affected Apache Solr versions: 7.5.0-10.0.0."
+ },
{
"vulnerability": {
"name": "CVE-2023-33201"
@@ -4131,14 +4176,44 @@
},
"products": [
{
- "@id": "lz4-java-1.10.1.jar"
+ "@id": "lz4-java-1.8.0.jar"
}
],
"status": "not_affected",
"timestamp": "2026-07-31T00:00:00Z",
"justification": "vulnerable_code_not_in_execute_path",
- "impact_statement": "CVE-2026-59949 (CVSS 6.5) is an out-of-bounds read
in the `at.yawk.lz4:lz4-java` codec: the\nJNI-based XXHash implementations
insufficiently validate their byte-array arguments, so a caller that\npasses an
invalid array reference or an out-of-range `off`/`len` to the native XXHash
methods can\ncrash the JVM. It affects lz4-java \u2264 1.11.0 (fixed in
1.11.1). Exploitation requires an application\nto pass attacker-influenced
array/offset/length values into thos [...]
- "status_notes": "Affected Apache Solr versions: 9.0.0-10.0.0."
+ "impact_statement": "Three issues in the `at.yawk.lz4:lz4-java` codec
(the community-maintained fork of the discontinued\nlz4-java):\n\n*
**CVE-2026-59949** (CVSS 6.5) \u2014 out-of-bounds read: the JNI-based XXHash
implementations don't\n validate their byte-array arguments, so a caller
passing an invalid array reference or out-of-range\n `off`/`len` can crash the
JVM (fixed in 1.11.1).\n* **CVE-2025-12183** \u2014 out-of-bounds memory access
in the compression/decompression fun [...]
+ "status_notes": "Affected Apache Solr versions: 9.8.0-10.0.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2025-12183"
+ },
+ "products": [
+ {
+ "@id": "lz4-java-1.8.0.jar"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-07-31T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "Three issues in the `at.yawk.lz4:lz4-java` codec
(the community-maintained fork of the discontinued\nlz4-java):\n\n*
**CVE-2026-59949** (CVSS 6.5) \u2014 out-of-bounds read: the JNI-based XXHash
implementations don't\n validate their byte-array arguments, so a caller
passing an invalid array reference or out-of-range\n `off`/`len` can crash the
JVM (fixed in 1.11.1).\n* **CVE-2025-12183** \u2014 out-of-bounds memory access
in the compression/decompression fun [...]
+ "status_notes": "Affected Apache Solr versions: 9.8.0-10.0.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2025-66566"
+ },
+ "products": [
+ {
+ "@id": "lz4-java-1.8.0.jar"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-07-31T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "Three issues in the `at.yawk.lz4:lz4-java` codec
(the community-maintained fork of the discontinued\nlz4-java):\n\n*
**CVE-2026-59949** (CVSS 6.5) \u2014 out-of-bounds read: the JNI-based XXHash
implementations don't\n validate their byte-array arguments, so a caller
passing an invalid array reference or out-of-range\n `off`/`len` can crash the
JVM (fixed in 1.11.1).\n* **CVE-2025-12183** \u2014 out-of-bounds memory access
in the compression/decompression fun [...]
+ "status_notes": "Affected Apache Solr versions: 9.8.0-10.0.0."
},
{
"vulnerability": {
diff --git a/output/solr.vex.json b/output/solr.vex.json
index d404718b5..4a43dbd41 100644
--- a/output/solr.vex.json
+++ b/output/solr.vex.json
@@ -7,7 +7,7 @@
"name": "solr",
"version": "SNAPSHOT",
"type": "application",
- "bom-ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "bom-ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
},
"vulnerabilities": [
@@ -23,7 +23,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -39,7 +39,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -55,7 +55,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -71,7 +71,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -87,7 +87,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -103,7 +103,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -119,7 +119,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -135,7 +135,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -151,7 +151,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -167,7 +167,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -183,7 +183,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -199,7 +199,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -215,7 +215,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -231,7 +231,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -247,7 +247,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -263,7 +263,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -279,7 +279,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -295,7 +295,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -311,7 +311,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -327,7 +327,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -343,7 +343,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -359,7 +359,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -375,7 +375,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -391,7 +391,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -407,7 +407,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -423,7 +423,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -439,7 +439,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -455,7 +455,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -471,7 +471,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -487,7 +487,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -503,7 +503,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -519,7 +519,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -535,7 +535,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -551,7 +551,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -567,7 +567,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -583,7 +583,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -599,7 +599,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -615,7 +615,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -631,7 +631,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -647,7 +647,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -663,7 +663,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -679,7 +679,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -695,7 +695,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -711,7 +711,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -727,7 +727,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -743,7 +743,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -759,7 +759,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -775,7 +775,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -791,7 +791,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -807,7 +807,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -823,7 +823,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -839,7 +839,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -855,7 +855,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -871,7 +871,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -887,7 +887,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -903,7 +903,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -919,7 +919,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -935,7 +935,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -951,7 +951,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -970,7 +970,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -986,7 +986,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1002,7 +1002,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1018,7 +1018,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1037,7 +1037,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1053,7 +1053,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1070,7 +1070,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1087,7 +1087,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1104,7 +1104,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1121,7 +1121,58 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ }
+ ]
+ },
+ {
+ "id": "CVE-2021-41182",
+ "source": {
+ "name": "NVD",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41182";
+ },
+ "analysis": {
+ "state": "not_affected",
+ "justification": "code_not_reachable",
+ "detail": "Three XSS issues in jQuery UI 1.12.1 (all fixed in
1.13.x):\n\n* **CVE-2021-41182** \u2014 XSS via the datepicker `altField`
option.\n* **CVE-2021-41183** \u2014 XSS via the datepicker `*Text` options.\n*
**CVE-2021-41184** \u2014 XSS via the `.position()` `of` option.\n\nSolr's
Admin UI bundles a **custom subset** of jQuery UI
(`server/solr-webapp/webapp/libs/jquery-ui.min.js`,\nv1.12.1) from Solr 7.5.0
through 10.0.0. Solr is **not affected**:\n\n* **The datepicker w [...]
+ },
+ "affects": [
+ {
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ }
+ ]
+ },
+ {
+ "id": "CVE-2021-41183",
+ "source": {
+ "name": "NVD",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41183";
+ },
+ "analysis": {
+ "state": "not_affected",
+ "justification": "code_not_reachable",
+ "detail": "Three XSS issues in jQuery UI 1.12.1 (all fixed in
1.13.x):\n\n* **CVE-2021-41182** \u2014 XSS via the datepicker `altField`
option.\n* **CVE-2021-41183** \u2014 XSS via the datepicker `*Text` options.\n*
**CVE-2021-41184** \u2014 XSS via the `.position()` `of` option.\n\nSolr's
Admin UI bundles a **custom subset** of jQuery UI
(`server/solr-webapp/webapp/libs/jquery-ui.min.js`,\nv1.12.1) from Solr 7.5.0
through 10.0.0. Solr is **not affected**:\n\n* **The datepicker w [...]
+ },
+ "affects": [
+ {
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ }
+ ]
+ },
+ {
+ "id": "CVE-2021-41184",
+ "source": {
+ "name": "NVD",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41184";
+ },
+ "analysis": {
+ "state": "not_affected",
+ "justification": "code_not_reachable",
+ "detail": "Three XSS issues in jQuery UI 1.12.1 (all fixed in
1.13.x):\n\n* **CVE-2021-41182** \u2014 XSS via the datepicker `altField`
option.\n* **CVE-2021-41183** \u2014 XSS via the datepicker `*Text` options.\n*
**CVE-2021-41184** \u2014 XSS via the `.position()` `of` option.\n\nSolr's
Admin UI bundles a **custom subset** of jQuery UI
(`server/solr-webapp/webapp/libs/jquery-ui.min.js`,\nv1.12.1) from Solr 7.5.0
through 10.0.0. Solr is **not affected**:\n\n* **The datepicker w [...]
+ },
+ "affects": [
+ {
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1138,7 +1189,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1155,7 +1206,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1172,7 +1223,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1189,7 +1240,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1206,7 +1257,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1223,7 +1274,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1240,7 +1291,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1257,7 +1308,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1274,7 +1325,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1291,7 +1342,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1308,7 +1359,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1325,7 +1376,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1342,7 +1393,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1359,7 +1410,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1376,7 +1427,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1393,7 +1444,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1413,7 +1464,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1433,7 +1484,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1453,7 +1504,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1470,7 +1521,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1490,7 +1541,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1507,7 +1558,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1524,7 +1575,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1541,7 +1592,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1558,7 +1609,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1575,7 +1626,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1592,7 +1643,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1609,7 +1660,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1626,7 +1677,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1643,7 +1694,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1660,7 +1711,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1677,7 +1728,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1694,7 +1745,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1711,7 +1762,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1728,7 +1779,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1745,7 +1796,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1762,7 +1813,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1779,7 +1830,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1796,7 +1847,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1813,7 +1864,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1830,7 +1881,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1847,7 +1898,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1864,7 +1915,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1881,7 +1932,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1898,7 +1949,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1915,7 +1966,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1932,7 +1983,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1949,7 +2000,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1966,7 +2017,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -1983,7 +2034,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -2000,7 +2051,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -2017,7 +2068,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -2034,7 +2085,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -2051,7 +2102,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -2068,7 +2119,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -2085,7 +2136,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -2102,7 +2153,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -2119,7 +2170,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -2136,7 +2187,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -2153,7 +2204,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -2170,7 +2221,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -2187,7 +2238,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -2204,7 +2255,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -2221,7 +2272,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -2238,7 +2289,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -2255,7 +2306,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -2272,7 +2323,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -2289,7 +2340,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -2306,7 +2357,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -2323,7 +2374,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -2340,7 +2391,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -2357,7 +2408,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -2374,7 +2425,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -2391,7 +2442,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -2404,11 +2455,45 @@
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
- "detail": "CVE-2026-59949 (CVSS 6.5) is an out-of-bounds read in the
`at.yawk.lz4:lz4-java` codec: the\nJNI-based XXHash implementations
insufficiently validate their byte-array arguments, so a caller that\npasses an
invalid array reference or an out-of-range `off`/`len` to the native XXHash
methods can\ncrash the JVM. It affects lz4-java \u2264 1.11.0 (fixed in
1.11.1). Exploitation requires an application\nto pass attacker-influenced
array/offset/length values into those XXHash [...]
+ "detail": "Three issues in the `at.yawk.lz4:lz4-java` codec (the
community-maintained fork of the discontinued\nlz4-java):\n\n*
**CVE-2026-59949** (CVSS 6.5) \u2014 out-of-bounds read: the JNI-based XXHash
implementations don't\n validate their byte-array arguments, so a caller
passing an invalid array reference or out-of-range\n `off`/`len` can crash the
JVM (fixed in 1.11.1).\n* **CVE-2025-12183** \u2014 out-of-bounds memory access
in the compression/decompression functions,\ [...]
+ },
+ "affects": [
+ {
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ }
+ ]
+ },
+ {
+ "id": "CVE-2025-12183",
+ "source": {
+ "name": "NVD",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12183";
+ },
+ "analysis": {
+ "state": "not_affected",
+ "justification": "code_not_reachable",
+ "detail": "Three issues in the `at.yawk.lz4:lz4-java` codec (the
community-maintained fork of the discontinued\nlz4-java):\n\n*
**CVE-2026-59949** (CVSS 6.5) \u2014 out-of-bounds read: the JNI-based XXHash
implementations don't\n validate their byte-array arguments, so a caller
passing an invalid array reference or out-of-range\n `off`/`len` can crash the
JVM (fixed in 1.11.1).\n* **CVE-2025-12183** \u2014 out-of-bounds memory access
in the compression/decompression functions,\ [...]
+ },
+ "affects": [
+ {
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
+ }
+ ]
+ },
+ {
+ "id": "CVE-2025-66566",
+ "source": {
+ "name": "NVD",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66566";
+ },
+ "analysis": {
+ "state": "not_affected",
+ "justification": "code_not_reachable",
+ "detail": "Three issues in the `at.yawk.lz4:lz4-java` codec (the
community-maintained fork of the discontinued\nlz4-java):\n\n*
**CVE-2026-59949** (CVSS 6.5) \u2014 out-of-bounds read: the JNI-based XXHash
implementations don't\n validate their byte-array arguments, so a caller
passing an invalid array reference or out-of-range\n `off`/`len` can crash the
JVM (fixed in 1.11.1).\n* **CVE-2025-12183** \u2014 out-of-bounds memory access
in the compression/decompression functions,\ [...]
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -2425,7 +2510,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -2442,7 +2527,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
},
@@ -2459,7 +2544,7 @@
},
"affects": [
{
- "ref": "e22c34d6-f32d-5e6d-8eb9-80150ea57c7c"
+ "ref": "def1bb6c-f3c0-5768-b3d2-725c0918d64f"
}
]
}
diff --git a/output/vex.html b/output/vex.html
index a15d71ea7..630f77cb0 100644
--- a/output/vex.html
+++ b/output/vex.html
@@ -246,33 +246,49 @@ host-dependent security decision, the host-confusion has
no exploitable conseque
</article>
<article id="cve-2026-59949" class="post panel radius">
<header class="post-header">
- <h3 class="title"><a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-59949";>CVE-2026-59949</a>,
lz4-java: out-of-bounds read via invalid arguments to native XXHash</h3>
+ <h3 class="title"><a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-59949";>CVE-2026-59949</a>, <a
href="https://nvd.nist.gov/vuln/detail/CVE-2025-12183";>CVE-2025-12183</a>, <a
href="https://nvd.nist.gov/vuln/detail/CVE-2025-66566";>CVE-2025-66566</a>,
lz4-java: out-of-bounds access and buffer-reuse disclosure in
(de)compression</h3>
<div class="panel callout">
+ <p class="subheader">
+ <strong>Published:</strong>
+ <time
datetime="2026-07-31T00:00:00+00:00">2026-07-31</time>
+ </p>
<p class="subheader">
<strong>Status:</strong>
<span class="cdx-not-affected">not_affected</span>
</p>
- <p class="subheader"><strong>Affected Solr
versions:</strong> 9.0.0-10.0.0</p>
+ <p class="subheader"><strong>Affected Solr
versions:</strong> 9.8.0-10.0.0</p>
</div>
</header>
<h4>Description</h4>
- <p>CVE-2026-59949 (CVSS 6.5) is an out-of-bounds read in the
<code>at.yawk.lz4:lz4-java</code> codec: the
-JNI-based XXHash implementations insufficiently validate their byte-array
arguments, so a caller that
-passes an invalid array reference or an out-of-range
<code>off</code>/<code>len</code> to the native XXHash methods can
-crash the JVM. It affects lz4-java ≤ 1.11.0 (fixed in 1.11.1). Exploitation
requires an application
-to pass attacker-influenced array/offset/length values into those XXHash
APIs.</p>
-<p>Solr is <strong>not affected</strong>. <code>lz4-java</code> is bundled
only by the optional <code>cross-dc</code> module, where it is
-used by the embedded Apache Kafka client for LZ4 compression / checksums of
cross-datacenter
-replication messages. Kafka calls the XXHash APIs with its own
internally-managed, validated buffers
-and offsets — it does not forward attacker-controlled
<code>off</code>/<code>len</code> values into the native methods —
-and the replication stream flows through an operator-controlled Kafka
pipeline, not untrusted
-external input. The <code>cross-dc</code> module is not part of a default Solr
installation, and no Solr request
-path reaches the vulnerable XXHash argument handling.</p>
+ <p>Three issues in the <code>at.yawk.lz4:lz4-java</code> codec
(the community-maintained fork of the discontinued
+lz4-java):</p>
+<ul>
+<li><strong>CVE-2026-59949</strong> (CVSS 6.5) — out-of-bounds read: the
JNI-based XXHash implementations don't
+ validate their byte-array arguments, so a caller passing an invalid array
reference or out-of-range
+ <code>off</code>/<code>len</code> can crash the JVM (fixed in 1.11.1).</li>
+<li><strong>CVE-2025-12183</strong> — out-of-bounds memory access in the
compression/decompression functions,
+ leading to denial of service and possible information disclosure when
processing untrusted input
+ (fixed in 1.8.1).</li>
+<li><strong>CVE-2025-66566</strong> — the Java decompressor does not clear
reused output buffers, so crafted
+ compressed input can read previous buffer contents when an output buffer is
reused (fixed in
+ 1.10.1).</li>
+</ul>
+<p>All three affect the <code>lz4-java</code> 1.8.0 that Solr's released 9.8.0
– 10.0.0 line bundles (SOLR-18013
+tracks the upgrade to 1.10.1). Each is reachable only when an application
feeds attacker-controlled
+input to the codec, or passes attacker-influenced arguments into it.</p>
+<p>Solr is <strong>not affected</strong>. <code>lz4-java</code> is bundled
only by the optional <code>cross-dc</code> module, where the
+embedded Apache Kafka client uses it to (de)compress and checksum
cross-datacenter replication
+messages. Those messages flow through an <strong>operator-controlled</strong>
Kafka pipeline (Solr's own cross-DC
+producer → the operator's Kafka → Solr's consumer), not untrusted external
input, and Kafka calls the
+codec with its own internally-managed, validated buffers and offsets rather
than forwarding
+attacker-controlled arguments. The <code>cross-dc</code> module is not part of
a default Solr installation, and
+no Solr request path reaches the vulnerable compression/decompression or
XXHash code.</p>
<h4>References</h4>
<ul>
- <li>CVE: <a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-59949";>CVE-2026-59949</a></li>
+ <li>JIRA: <a
href="https://issues.apache.org/jira/browse/SOLR-18013";>SOLR-18013</a></li>
+ <li>CVE: <a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-59949";>CVE-2026-59949</a>, <a
href="https://nvd.nist.gov/vuln/detail/CVE-2025-12183";>CVE-2025-12183</a>, <a
href="https://nvd.nist.gov/vuln/detail/CVE-2025-66566";>CVE-2025-66566</a></li>
</ul>
</article>
<article id="cve-2026-59899" class="post panel radius">
@@ -2693,6 +2709,54 @@ module, fixed to 1.78.1 in 9.7; the same not-affected
reasoning applies.)</p>
<li>CVE: <a
href="https://nvd.nist.gov/vuln/detail/CVE-2023-33201";>CVE-2023-33201</a>, <a
href="https://nvd.nist.gov/vuln/detail/CVE-2024-29857";>CVE-2024-29857</a>, <a
href="https://nvd.nist.gov/vuln/detail/CVE-2024-30171";>CVE-2024-30171</a>, <a
href="https://nvd.nist.gov/vuln/detail/CVE-2024-30172";>CVE-2024-30172</a></li>
</ul>
</article>
+ <article id="cve-2021-41182" class="post panel radius">
+ <header class="post-header">
+ <h3 class="title"><a
href="https://nvd.nist.gov/vuln/detail/CVE-2021-41182";>CVE-2021-41182</a>, <a
href="https://nvd.nist.gov/vuln/detail/CVE-2021-41183";>CVE-2021-41183</a>, <a
href="https://nvd.nist.gov/vuln/detail/CVE-2021-41184";>CVE-2021-41184</a>,
jQuery UI (Admin UI): XSS in datepicker and position widgets</h3>
+ <div class="panel callout">
+ <p class="subheader">
+ <strong>Published:</strong>
+ <time
datetime="2025-09-07T00:00:00+00:00">2025-09-07</time>
+ </p>
+ <p class="subheader">
+ <strong>Status:</strong>
+ <span class="cdx-not-affected">not_affected</span>
+ </p>
+ <p class="subheader"><strong>Affected Solr
versions:</strong> 7.5.0-10.0.0</p>
+ </div>
+ </header>
+
+ <h4>Description</h4>
+ <p>Three XSS issues in jQuery UI 1.12.1 (all fixed in
1.13.x):</p>
+<ul>
+<li><strong>CVE-2021-41182</strong> — XSS via the datepicker
<code>altField</code> option.</li>
+<li><strong>CVE-2021-41183</strong> — XSS via the datepicker
<code>*Text</code> options.</li>
+<li><strong>CVE-2021-41184</strong> — XSS via the <code>.position()</code>
<code>of</code> option.</li>
+</ul>
+<p>Solr's Admin UI bundles a <strong>custom subset</strong> of jQuery UI
(<code>server/solr-webapp/webapp/libs/jquery-ui.min.js</code>,
+v1.12.1) from Solr 7.5.0 through 10.0.0. Solr is <strong>not
affected</strong>:</p>
+<ul>
+<li><strong>The datepicker widget is not included.</strong> Solr's build
excludes datepicker entirely (it is absent
+ from the shipped <code>jquery-ui.min.js</code>), so CVE-2021-41182 and
CVE-2021-41183 — both datepicker-only —
+ have no code present to exploit.</li>
+<li><strong>The position utility is included, but not reachable with attacker
input.</strong> CVE-2021-41184
+ requires passing attacker-controlled markup to the <code>of</code> option of
<code>.position()</code>. Solr's Admin UI
+ invokes positioning (for tooltips/dialogs) only with its own static, trusted
selectors, never with
+ externally-supplied values. The Admin UI is also an operator-facing console,
not an
+ unauthenticated public surface.</li>
+</ul>
+<blockquote>
+<p>Note: this is a <strong>front-end JavaScript</strong> dependency, not a
Maven artifact. This entry documents
+Solr's assessment for the record; unlike the Java-jar entries it does not emit
a matchable Maven
+purl, and Docker Scout does not flag the bundled minified JS. It corresponds
to SOLR-16309, whose
+reporter likewise characterized it as a compliance finding rather than an
exploitable risk.</p>
+</blockquote>
+
+ <h4>References</h4>
+ <ul>
+ <li>JIRA: <a
href="https://issues.apache.org/jira/browse/SOLR-16309";>SOLR-16309</a></li>
+ <li>CVE: <a
href="https://nvd.nist.gov/vuln/detail/CVE-2021-41182";>CVE-2021-41182</a>, <a
href="https://nvd.nist.gov/vuln/detail/CVE-2021-41183";>CVE-2021-41183</a>, <a
href="https://nvd.nist.gov/vuln/detail/CVE-2021-41184";>CVE-2021-41184</a></li>
+ </ul>
+ </article>
<article id="cve-2020-13949" class="post panel radius">
<header class="post-header">
<h3 class="title"><a
href="https://nvd.nist.gov/vuln/detail/CVE-2020-13949";>CVE-2020-13949</a>,
Apache Thrift: server-side memory-exhaustion DoS via crafted short messages</h3>
