This is an automated email from the ASF dual-hosted git repository.
github-actions[bot] pushed a commit to branch asf-staging
in repository https://gitbox.apache.org/repos/asf/solr-site.git
The following commit(s) were added to refs/heads/asf-staging by this push:
new e52305d1b Commit build products
e52305d1b is described below
commit e52305d1bc7ac37515211caf077e5e6163f8deb4
Author: Build Pelican (action) <[email protected]>
AuthorDate: Tue Sep 1 16:03:42 2026 +0000
Commit build products
---
output/feeds/all.atom.xml | 208 ++++++++-----------
output/feeds/solr/vex.atom.xml | 97 +++++++--
output/security-dependency-cves.html | 36 ++++
output/solr.openvex.json | 62 +++++-
output/solr.vex.json | 378 +++++++++++++++++++++--------------
output/vex.html | 147 ++++++++++++++
6 files changed, 629 insertions(+), 299 deletions(-)
diff --git a/output/feeds/all.atom.xml b/output/feeds/all.atom.xml
index 42fff68b2..6a05abb78 100644
--- a/output/feeds/all.atom.xml
+++ b/output/feeds/all.atom.xml
@@ -1,5 +1,84 @@
<?xml version="1.0" encoding="utf-8"?>
-<feed xmlns="http://www.w3.org/2005/Atom";><title>Apache Solr</title><link
href="/" rel="alternate"/><link href="/feeds/all.atom.xml"
rel="self"/><id>/</id><updated>2026-08-23T00:00:00+00:00</updated><entry><title>Netty:
SslHandler native crash on crafted packets</title><link
href="/cve-2025-24970.html"
rel="alternate"/><published>2026-08-23T00:00:00+00:00</published><updated>2026-08-23T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-08-23:/cve-2025- [...]
+<feed xmlns="http://www.w3.org/2005/Atom";><title>Apache Solr</title><link
href="/" rel="alternate"/><link href="/feeds/all.atom.xml"
rel="self"/><id>/</id><updated>2026-08-25T00:00:00+00:00</updated><entry><title>ws:
memory exhaustion denial of service from tiny WebSocket fragments</title><link
href="/cve-2026-48779.html"
rel="alternate"/><published>2026-08-25T00:00:00+00:00</published><updated>2026-08-25T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2 [...]
+a peer that sends a high volume of exceptionally small message fragments can
force the receiving side
+to allocate and retain structural wrappers far larger than the documented
message-size limit,
+eventually exhausting memory. It affects <code>ws</code> 8
…</p></summary><content type="html"><p>CVE-2026-48779 is a
memory-exhaustion denial-of-service issue in the Node.js
<code>ws</code> WebSocket library:
+a peer that sends a high volume of exceptionally small message fragments can
force the receiving side
+to allocate and retain structural wrappers far larger than the documented
message-size limit,
+eventually exhausting memory. It affects <code>ws</code> 8.0.0
through 8.20.x; fixed in 8.21.0 (with backports
+to the 5.x/6.x/7.x lines for older major versions).</p>
+<p>Solr is <strong>not affected</strong>.
<code>ws</code> is pinned in
<code>kotlin-js-store/wasm/yarn.lock</code>, an auto-generated
+lockfile for the Kotlin/Wasm build toolchain that compiles the new
Compose-based Admin UI
+(<code>solr/ui</code>). It is a transitive dependency of that
toolchain's Node.js-based dev-server/test-runner
+tooling, not of Solr's own code. <code>ws</code> depends on
Node.js's native TCP socket APIs, which don't exist
+in a browser sandbox -- it is therefore not possible for it to be bundled into
the actual
+browser-executable Wasm/JS output that ships to end users and runs in their
browser. This isn't a
+case of unreachable-but-present code; the vulnerable component is never part
of the shipped product
+artifact at all, only of the build/test pipeline that produces it.</p>
+<p><code>ws</code> has been present in
<code>solr/ui</code>'s build tooling since it was first introduced
(shipped in the
+10.0.0 release at
<code>[email protected]</code>/<code>[email protected]</code>, both
within the affected range). <code>branch_9x</code> doesn't have
+this module at all. Since this dependency never reaches a shipped artifact, no
application-level fix
+is required; bumping it is worth doing as routine build-tooling hygiene
regardless, since a compromised
+or misbehaving local/CI dev-server dependency is still worth avoiding even
without direct product
+exposure.</p></content><category
term="solr/vex"/></entry><entry><title>Apache HttpComponents Core: HTTP/1
header parsing memory-exhaustion denial of service</title><link
href="/cve-2026-54399.html"
rel="alternate"/><published>2026-08-25T00:00:00+00:00</published><updated>2026-08-25T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-08-25:/cve-2026-54399.html</id><summary
type="html"><p>CVE-2026-54399 is an uncontrolled-resource-consumption
[...]
+message parser: a remote peer can send messages with an excessive number of
headers or excessive
+header length, exhausting memory and causing a denial of service. It affects
<code>httpcore5</code> 5.4.2 and
+earlier (and 5.5-beta1 and …</p></summary><content
type="html"><p>CVE-2026-54399 is an uncontrolled-resource-consumption
issue in Apache HttpComponents Core's HTTP/1.1
+message parser: a remote peer can send messages with an excessive number of
headers or excessive
+header length, exhausting memory and causing a denial of service. It affects
<code>httpcore5</code> 5.4.2 and
+earlier (and 5.5-beta1 and earlier); fixed in 5.4.3.</p>
+<p>Solr is <strong>not affected</strong>.
<code>httpcore5</code> is bundled transitively by
+<code>org.apache.calcite.avatica:avatica-core</code>, which uses
it to support Avatica's <em>optional remote-JDBC</em>
+HTTP transport -- see the companion VEX entry for CVE-2026-64607
(<code>httpclient5</code>) for the full
+reachability analysis, which applies identically here: Solr's
<code>/sql</code> handler never uses Avatica's
+remote HTTP transport, only the local embedded
<code>CalciteConnection</code>, so
<code>httpcore5</code>'s HTTP/1.1 message
+parser is never invoked to process any inbound message, trusted or otherwise.
The dependency is
+<code>permitUnusedDeclared</code> in Solr's own build and shipped
only via the optional <code>solr:modules:sql</code>
+module.</p>
+<p>Solr has shipped an affected <code>httpcore5</code> since
at least 9.1.0 (through 10.0.0, and continuing on
+<code>branch_10x</code>/<code>main</code> at 5.3.5).
<code>branch_9x</code> has since moved to 5.4.3, exactly the fix
version --
+picked up incidentally via routine dependency maintenance, not a targeted fix
for this CVE. Since the
+code path is unreachable regardless, no fix is required on
<code>branch_10x</code>/<code>main</code>
either.</p></content><category
term="solr/vex"/></entry><entry><title>Apache HttpComponents Core: HPACK
decoder unlimited header list size before SETTINGS ACK</title><link
href="/cve-2026-54428.html"
rel="alternate"/><published>2026-08-25T00:00:00+00:00</published><updated>2026-08-25T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag [...]
+decoder: before an HTTP/2 peer's <code>SETTINGS</code> frame is
acknowledged, the configured header list size
+limit isn't yet applied, so a remote peer can send oversized compressed header
blocks and exhaust
+memory, causing a denial of service. It …</p></summary><content
type="html"><p>CVE-2026-54428 is an allocation-without-limits issue in
Apache HttpComponents Core's HTTP/2 HPACK
+decoder: before an HTTP/2 peer's <code>SETTINGS</code> frame is
acknowledged, the configured header list size
+limit isn't yet applied, so a remote peer can send oversized compressed header
blocks and exhaust
+memory, causing a denial of service. It affects
<code>httpcore5-h2</code> 5.4.2 and earlier (and 5.5-beta1 and
+earlier); fixed in 5.4.3.</p>
+<p>Solr is <strong>not affected</strong>.
<code>httpcore5-h2</code> is bundled transitively by
+<code>org.apache.calcite.avatica:avatica-core</code>, which uses
it to support Avatica's <em>optional remote-JDBC</em>
+HTTP/2 transport -- see the companion VEX entry for CVE-2026-64607
(<code>httpclient5</code>) for the full
+reachability analysis, which applies identically here: Solr's
<code>/sql</code> handler never uses Avatica's
+remote HTTP transport, only the local embedded
<code>CalciteConnection</code>, so the HPACK decoder this CVE
+concerns -- which only runs when HttpComponents is actually acting as an
HTTP/2 endpoint -- is never
+invoked. The dependency is <code>permitUnusedDeclared</code> in
Solr's own build and shipped only via the
+optional <code>solr:modules:sql</code> module.</p>
+<p>Solr has shipped an affected <code>httpcore5-h2</code>
since at least 9.1.0 (through 10.0.0, and continuing on
+<code>branch_10x</code>/<code>main</code> at 5.3.4).
<code>branch_9x</code> has since moved to 5.4.3, exactly the fix
version --
+picked up incidentally via routine dependency maintenance, not a targeted fix
for this CVE. Since the
+code path is unreachable regardless, no fix is required on
<code>branch_10x</code>/<code>main</code>
either.</p></content><category
term="solr/vex"/></entry><entry><title>Apache HttpComponents Client: connection
leak on Content-Encoding decode error</title><link href="/cve-2026-64607.html"
rel="alternate"/><published>2026-08-25T00:00:00+00:00</published><updated>2026-08-25T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026 [...]
+(blocking) I/O model: if a response has an invalid or unsupported
<code>Content-Encoding</code> header, the
+client fails to release the underlying connection back to the connection
manager, eventually
+exhausting the pool and causing a denial of service. It
…</p></summary><content type="html"><p>CVE-2026-64607 (medium
severity) is a connection-leak bug in Apache HttpComponents Client's classic
+(blocking) I/O model: if a response has an invalid or unsupported
<code>Content-Encoding</code> header, the
+client fails to release the underlying connection back to the connection
manager, eventually
+exhausting the pool and causing a denial of service. It does not affect
HttpClient's async I/O model.
+It affects <code>httpclient5</code> from 5.0-alpha1 through 5.6.2;
fixed in 5.6.3.</p>
+<p>Solr is <strong>not affected</strong>.
<code>httpclient5</code> (along with
<code>httpcore5</code> and <code>httpcore5-h2</code>,
covered in
+separate VEX entries for their own CVEs) is bundled transitively by
<code>org.apache.calcite.avatica:avatica-core</code>,
+which uses it to support Avatica's <em>optional remote-JDBC</em>
transport -- connecting to a remote Avatica
+server over HTTP. Solr's own <code>/sql</code> handler
(<code>CalciteSolrDriver</code>) only ever opens a local, in-process
+<code>org.apache.calcite.jdbc.CalciteConnection</code>; there is
no
<code>org.apache.hc.client5</code>/<code>org.apache.hc.core5</code>
+usage anywhere in <code>solr/modules/sql</code>'s source, and Solr
never acts as an Avatica HTTP client or server.
+The dependency has in fact been marked
<code>permitUnusedDeclared</code> in Solr's own build since at
least the
+10.0.0 release, confirming the build's own dependency-analysis tooling already
recognized it as
+present-but-unused. It's also shipped only via the optional
<code>solr:modules:sql</code> module -- every other
+place it appears (<code>solrj-streaming</code>,
<code>solr-ref-guide</code>, <code>webapp</code>) is
test-scope only, not shipped.</p>
+<p>Solr has shipped an affected <code>httpclient5</code>
since at least 9.1.0 (through 10.0.0, and continuing on
+<code>branch_10x</code>/<code>main</code> at 5.5).
<code>branch_9x</code> has since moved to 5.6.4, past the fix --
picked up
+incidentally via routine dependency maintenance, not a targeted fix for this
CVE. Since the code path
+is unreachable regardless, no fix is required on
<code>branch_10x</code>/<code>main</code>
either.</p></content><category
term="solr/vex"/></entry><entry><title>Netty: SslHandler native crash on
crafted packets</title><link href="/cve-2025-24970.html"
rel="alternate"/><published>2026-08-23T00:00:00+00:00</published><updated>2026-08-23T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-08-23:/cve-2025-24970.html</id><summar
[...]
<code>netty-tcnative</code>) TLS engine is in use, a specially
crafted packet received during TLS
processing is not properly validated, which can trigger a native crash (JVM
segfault) rather
than a clean exception. It affects Netty
<code>netty-handler</code> versions 4 …</p></summary><content
type="html"><p>CVE-2025-24970 is a flaw in Netty's
<code>SslHandler</code>: when the native (OpenSSL/BoringSSL, via
@@ -2300,129 +2379,4 @@ CVE - <a
href="https://nvd.nist.gov/vuln/detail/CVE-2024-31391">CVE-2024-3
<p>Please read CHANGES.txt for a full list of bugfixes:</p>
<p><a
href="https://solr.apache.org/docs/8_11_3/changes/Changes.html">https://solr.apache.org/docs/8_11_3/changes/Changes.html</a></p>
<p>Solr 8.11.3 also includes bugfixes in the corresponding Apache Lucene
release:</p>
-<p><a
href="https://lucene.apache.org/core/8_11_3/changes/Changes.html">https://lucene.apache.org/core/8_11_3/changes/Changes.html</a></p></content><category
term="solr/news"/></entry><entry><title>CVE-2023-50291: Apache Solr can leak
certain passwords due to System Property redaction logic
inconsistencies</title><link
href="/cve-2023-50291-apache-solr-can-leak-certain-passwords-due-to-system-property-redaction-logic-inconsistencies.html"
rel="alternate"/><publish [...]
-Moderate</p>
-<p><strong>Versions Affected:</strong></p>
-<ul>
-<li>Apache Solr 6.0.0 through 8.11.2</li>
-<li>Apache Solr 9.0.0 before 9.3.0</li>
-</ul>
-<p><strong>Description:</strong><br>
-Insufficiently Protected Credentials vulnerability in Apache Solr.</p>
-<p>This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0
before 9.3 …</p></summary><content
type="html"><p><strong>Severity:</strong><br>
-Moderate</p>
-<p><strong>Versions Affected:</strong></p>
-<ul>
-<li>Apache Solr 6.0.0 through 8.11.2</li>
-<li>Apache Solr 9.0.0 before 9.3.0</li>
-</ul>
-<p><strong>Description:</strong><br>
-Insufficiently Protected Credentials vulnerability in Apache Solr.</p>
-<p>This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0
before 9.3.0.
-One of the two endpoints that publishes the Solr process' Java system
properties, /admin/info/properties, was only setup to hide system properties
that had "password" contained in the name.
-There are a number of sensitive system properties, such as "basicauth" and
"aws.secretKey" do not contain "password", thus their values were published via
the "/admin/info/properties" endpoint.
-This endpoint populates the list of System Properties on the home screen of
the Solr Admin page, making the exposed credentials visible in the UI.</p>
-<p>This /admin/info/properties endpoint is protected under the
"config-read" permission.
-Therefore, Solr Clouds with Authorization enabled will only be vulnerable
through logged-in users that have the "config-read" permission.
-Users are recommended to upgrade to version 9.3.0 or 8.11.3, which fixes the
issue.
-A single option now controls hiding Java system property for all endpoints,
"-Dsolr.hiddenSysProps".
-By default all known sensitive properties are hidden (including
"-Dbasicauth"), as well as any property with a name containing "secret" or
"password".</p>
-<p>Users who cannot upgrade can also use the following Java system
property to fix the issue:<br>
-<code>-Dsolr.redaction.system.pattern=".*(password|secret|basicauth).*"</code></p>
-<p><strong>Mitigation:</strong><br>
-Users are recommended to upgrade to version 8.11.3, 9.3.0 or later, which has
consistent systemProperty redaction logic.</p>
-<p><strong>Credit:</strong>
-Michael Taggart (reporter)</p>
-<p><strong>References:</strong><br>
-JIRA - <a
href="https://issues.apache.org/jira/browse/SOLR-16809">SOLR-16809</a><br>
-CVE - <a
href="https://nvd.nist.gov/vuln/detail/CVE-2023-50291">CVE-2023-50291</a></p></content><category
term="solr/security"/></entry><entry><title>CVE-2023-50292: Apache Solr Schema
Designer blindly "trusts" all configsets, possibly leading to RCE by
unauthenticated users</title><link
href="/cve-2023-50292-apache-solr-schema-designer-blindly-trusts-all-configsets-possibly-leading-to-rce-by-unauthenticated-users.html"
rel="alternate"/><published>2024-02-08T00:00:00+00 [...]
-Moderate</p>
-<p><strong>Versions Affected:</strong></p>
-<ul>
-<li>Apache Solr 6.0.0 through 8.11.2</li>
-<li>Apache Solr 9.0.0 before 9.3.0</li>
-</ul>
-<p><strong>Description:</strong><br>
-Incorrect Permission Assignment for Critical Resource, Improper Control of
Dynamically-Managed Code Resources vulnerability in Apache Solr.</p>
-<p>This issue affects Apache Solr: from 8.10.0 through 8
…</p></summary><content
type="html"><p><strong>Severity:</strong><br>
-Moderate</p>
-<p><strong>Versions Affected:</strong></p>
-<ul>
-<li>Apache Solr 6.0.0 through 8.11.2</li>
-<li>Apache Solr 9.0.0 before 9.3.0</li>
-</ul>
-<p><strong>Description:</strong><br>
-Incorrect Permission Assignment for Critical Resource, Improper Control of
Dynamically-Managed Code Resources vulnerability in Apache Solr.</p>
-<p>This issue affects Apache Solr: from 8.10.0 through 8.11.2, from
9.0.0 before 9.3.0.</p>
-<p>The Schema Designer was introduced to allow users to more easily
configure and test new Schemas and configSets.
-However, when the feature was created, the "trust" (authentication) of these
configSets was not considered.
-External library loading is only available to configSets that are "trusted"
(created by authenticated users), thus non-authenticated users are unable to
perform Remote Code Execution.
-Since the Schema Designer loaded configSets without taking their "trust" into
account, configSets that were created by unauthenticated users were allowed to
load external libraries when used in the Schema Designer.</p>
-<p><strong>Mitigation:</strong><br>
-Users are recommended to upgrade to version 8.11.3, 9.3.0 or later.</p>
-<p><strong>Credit:</strong>
-Skay (reporter)</p>
-<p><strong>References:</strong><br>
-JIRA - <a
href="https://issues.apache.org/jira/browse/SOLR-16777">SOLR-16777</a><br>
-CVE - <a
href="https://nvd.nist.gov/vuln/detail/CVE-2023-50292">CVE-2023-50292</a></p></content><category
term="solr/security"/></entry><entry><title>CVE-2023-50298: Apache Solr can
expose ZooKeeper credentials via Streaming Expressions</title><link
href="/cve-2023-50298-apache-solr-can-expose-zookeeper-credentials-via-streaming-expressions.html"
rel="alternate"/><published>2024-02-08T00:00:00+00:00</published><updated>2024-02-08T00:00:00+00:00</updated><author><name>So
[...]
-Low</p>
-<p><strong>Versions Affected:</strong></p>
-<ul>
-<li>Apache Solr 6.0.0 through 8.11.2</li>
-<li>Apache Solr 9.0.0 before 9.4.1</li>
-</ul>
-<p><strong>Description:</strong><br>
-Exposure of Sensitive Information to an Unauthorized Actor vulnerability in
Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9
…</p></summary><content
type="html"><p><strong>Severity:</strong><br>
-Low</p>
-<p><strong>Versions Affected:</strong></p>
-<ul>
-<li>Apache Solr 6.0.0 through 8.11.2</li>
-<li>Apache Solr 9.0.0 before 9.4.1</li>
-</ul>
-<p><strong>Description:</strong><br>
-Exposure of Sensitive Information to an Unauthorized Actor vulnerability in
Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from
9.0.0 before 9.4.1.</p>
-<p>Solr Streaming Expressions allows users to extract data from other
Solr Clouds, using a "zkHost" parameter.
-When original SolrCloud is setup to use ZooKeeper credentials and ACLs, they
will be sent to whatever "zkHost" the user provides.
-An attacker could setup a server to mock ZooKeeper, that accepts ZooKeeper
requests with credentials and ACLs and extracts the sensitive information,
-then send a streaming expression using the mock server's address in "zkHost".
-Streaming Expressions are exposed via the "/streaming" handler, with "read"
permissions.</p>
-<p><strong>Mitigation:</strong><br>
-Users are recommended to upgrade to version 8.11.3 or 9.4.1, which fix the
issue.
-From these versions on, only zkHost values that have the same server address
(regardless of chroot), will use the given ZooKeeper credentials and ACLs when
connecting.</p>
-<p><strong>Credit:</strong>
-Qing Xu (reporter)</p>
-<p><strong>References:</strong><br>
-JIRA - <a
href="https://issues.apache.org/jira/browse/SOLR-17098">SOLR-17098</a><br>
-CVE - <a
href="https://nvd.nist.gov/vuln/detail/CVE-2023-50298">CVE-2023-50298</a></p></content><category
term="solr/security"/></entry><entry><title>CVE-2023-50386: Apache Solr:
Backup/Restore APIs allow for deployment of executables in malicious
ConfigSets</title><link
href="/cve-2023-50386-apache-solr-backuprestore-apis-allow-for-deployment-of-executables-in-malicious-configsets.html"
rel="alternate"/><published>2024-02-08T00:00:00+00:00</published><updated>2024-02-0
[...]
-Moderate</p>
-<p><strong>Versions Affected:</strong></p>
-<ul>
-<li>Apache Solr 6.0.0 through 8.11.2</li>
-<li>Apache Solr 9.0.0 before 9.4.1</li>
-</ul>
-<p><strong>Description:</strong><br>
-Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of
File with Dangerous Type, Inclusion of Functionality from Untrusted Control
Sphere vulnerability in Apache Solr.This issue affects
…</p></summary><content
type="html"><p><strong>Severity:</strong><br>
-Moderate</p>
-<p><strong>Versions Affected:</strong></p>
-<ul>
-<li>Apache Solr 6.0.0 through 8.11.2</li>
-<li>Apache Solr 9.0.0 before 9.4.1</li>
-</ul>
-<p><strong>Description:</strong><br>
-Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of
File with Dangerous Type, Inclusion of Functionality from Untrusted Control
Sphere vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0
through 8.11.2, from 9.0.0 before 9.4.1.</p>
-<p>In the affected versions, Solr ConfigSets accepted Java jar and class
files to be uploaded through the ConfigSets API.
-When backing up Solr Collections, these configSet files would be saved to disk
when using the LocalFileSystemRepository (the default for backups).
-If the backup was saved to a directory that Solr uses in its
ClassPath/ClassLoaders, then the jar and class files would be available to use
with any ConfigSet, trusted or untrusted.</p>
-<p>When Solr is run in a secure way (Authorization enabled), as is
strongly suggested, this vulnerability is limited to extending the Backup
permissions with the ability to add libraries.</p>
-<p><strong>Mitigation:</strong><br>
-Users are recommended to upgrade to version 8.11.3 or 9.4.1, which fix the
issue.
-In these versions, the following protections have been added:</p>
-<ul>
-<li>Users are no longer able to upload files to a configSet that could
be executed via a Java ClassLoader.</li>
-<li>The Backup API restricts saving backups to directories that are used
in the ClassLoader.</li>
-</ul>
-<p><strong>Credit:</strong>
-L3yx (reporter)</p>
-<p><strong>References:</strong><br>
-JIRA - <a
href="https://issues.apache.org/jira/browse/SOLR-16949">SOLR-16949</a><br>
-CVE - <a
href="https://nvd.nist.gov/vuln/detail/CVE-2023-50386">CVE-2023-50386</a></p></content><category
term="solr/security"/></entry></feed>
\ No newline at end of file
+<p><a
href="https://lucene.apache.org/core/8_11_3/changes/Changes.html">https://lucene.apache.org/core/8_11_3/changes/Changes.html</a></p></content><category
term="solr/news"/></entry></feed>
\ No newline at end of file
diff --git a/output/feeds/solr/vex.atom.xml b/output/feeds/solr/vex.atom.xml
index a8f7a1607..59d97caf8 100644
--- a/output/feeds/solr/vex.atom.xml
+++ b/output/feeds/solr/vex.atom.xml
@@ -1,5 +1,84 @@
<?xml version="1.0" encoding="utf-8"?>
-<feed xmlns="http://www.w3.org/2005/Atom";><title>Apache Solr -
solr/vex</title><link href="/" rel="alternate"/><link
href="/feeds/solr/vex.atom.xml"
rel="self"/><id>/</id><updated>2026-08-23T00:00:00+00:00</updated><entry><title>Netty:
SslHandler native crash on crafted packets</title><link
href="/cve-2025-24970.html"
rel="alternate"/><published>2026-08-23T00:00:00+00:00</published><updated>2026-08-23T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026- [...]
+<feed xmlns="http://www.w3.org/2005/Atom";><title>Apache Solr -
solr/vex</title><link href="/" rel="alternate"/><link
href="/feeds/solr/vex.atom.xml"
rel="self"/><id>/</id><updated>2026-08-25T00:00:00+00:00</updated><entry><title>ws:
memory exhaustion denial of service from tiny WebSocket fragments</title><link
href="/cve-2026-48779.html"
rel="alternate"/><published>2026-08-25T00:00:00+00:00</published><updated>2026-08-25T00:00:00+00:00</updated><author><name>Solr
Developers</name></autho [...]
+a peer that sends a high volume of exceptionally small message fragments can
force the receiving side
+to allocate and retain structural wrappers far larger than the documented
message-size limit,
+eventually exhausting memory. It affects <code>ws</code> 8
…</p></summary><content type="html"><p>CVE-2026-48779 is a
memory-exhaustion denial-of-service issue in the Node.js
<code>ws</code> WebSocket library:
+a peer that sends a high volume of exceptionally small message fragments can
force the receiving side
+to allocate and retain structural wrappers far larger than the documented
message-size limit,
+eventually exhausting memory. It affects <code>ws</code> 8.0.0
through 8.20.x; fixed in 8.21.0 (with backports
+to the 5.x/6.x/7.x lines for older major versions).</p>
+<p>Solr is <strong>not affected</strong>.
<code>ws</code> is pinned in
<code>kotlin-js-store/wasm/yarn.lock</code>, an auto-generated
+lockfile for the Kotlin/Wasm build toolchain that compiles the new
Compose-based Admin UI
+(<code>solr/ui</code>). It is a transitive dependency of that
toolchain's Node.js-based dev-server/test-runner
+tooling, not of Solr's own code. <code>ws</code> depends on
Node.js's native TCP socket APIs, which don't exist
+in a browser sandbox -- it is therefore not possible for it to be bundled into
the actual
+browser-executable Wasm/JS output that ships to end users and runs in their
browser. This isn't a
+case of unreachable-but-present code; the vulnerable component is never part
of the shipped product
+artifact at all, only of the build/test pipeline that produces it.</p>
+<p><code>ws</code> has been present in
<code>solr/ui</code>'s build tooling since it was first introduced
(shipped in the
+10.0.0 release at
<code>[email protected]</code>/<code>[email protected]</code>, both
within the affected range). <code>branch_9x</code> doesn't have
+this module at all. Since this dependency never reaches a shipped artifact, no
application-level fix
+is required; bumping it is worth doing as routine build-tooling hygiene
regardless, since a compromised
+or misbehaving local/CI dev-server dependency is still worth avoiding even
without direct product
+exposure.</p></content><category
term="solr/vex"/></entry><entry><title>Apache HttpComponents Core: HTTP/1
header parsing memory-exhaustion denial of service</title><link
href="/cve-2026-54399.html"
rel="alternate"/><published>2026-08-25T00:00:00+00:00</published><updated>2026-08-25T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-08-25:/cve-2026-54399.html</id><summary
type="html"><p>CVE-2026-54399 is an uncontrolled-resource-consumption
[...]
+message parser: a remote peer can send messages with an excessive number of
headers or excessive
+header length, exhausting memory and causing a denial of service. It affects
<code>httpcore5</code> 5.4.2 and
+earlier (and 5.5-beta1 and …</p></summary><content
type="html"><p>CVE-2026-54399 is an uncontrolled-resource-consumption
issue in Apache HttpComponents Core's HTTP/1.1
+message parser: a remote peer can send messages with an excessive number of
headers or excessive
+header length, exhausting memory and causing a denial of service. It affects
<code>httpcore5</code> 5.4.2 and
+earlier (and 5.5-beta1 and earlier); fixed in 5.4.3.</p>
+<p>Solr is <strong>not affected</strong>.
<code>httpcore5</code> is bundled transitively by
+<code>org.apache.calcite.avatica:avatica-core</code>, which uses
it to support Avatica's <em>optional remote-JDBC</em>
+HTTP transport -- see the companion VEX entry for CVE-2026-64607
(<code>httpclient5</code>) for the full
+reachability analysis, which applies identically here: Solr's
<code>/sql</code> handler never uses Avatica's
+remote HTTP transport, only the local embedded
<code>CalciteConnection</code>, so
<code>httpcore5</code>'s HTTP/1.1 message
+parser is never invoked to process any inbound message, trusted or otherwise.
The dependency is
+<code>permitUnusedDeclared</code> in Solr's own build and shipped
only via the optional <code>solr:modules:sql</code>
+module.</p>
+<p>Solr has shipped an affected <code>httpcore5</code> since
at least 9.1.0 (through 10.0.0, and continuing on
+<code>branch_10x</code>/<code>main</code> at 5.3.5).
<code>branch_9x</code> has since moved to 5.4.3, exactly the fix
version --
+picked up incidentally via routine dependency maintenance, not a targeted fix
for this CVE. Since the
+code path is unreachable regardless, no fix is required on
<code>branch_10x</code>/<code>main</code>
either.</p></content><category
term="solr/vex"/></entry><entry><title>Apache HttpComponents Core: HPACK
decoder unlimited header list size before SETTINGS ACK</title><link
href="/cve-2026-54428.html"
rel="alternate"/><published>2026-08-25T00:00:00+00:00</published><updated>2026-08-25T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag [...]
+decoder: before an HTTP/2 peer's <code>SETTINGS</code> frame is
acknowledged, the configured header list size
+limit isn't yet applied, so a remote peer can send oversized compressed header
blocks and exhaust
+memory, causing a denial of service. It …</p></summary><content
type="html"><p>CVE-2026-54428 is an allocation-without-limits issue in
Apache HttpComponents Core's HTTP/2 HPACK
+decoder: before an HTTP/2 peer's <code>SETTINGS</code> frame is
acknowledged, the configured header list size
+limit isn't yet applied, so a remote peer can send oversized compressed header
blocks and exhaust
+memory, causing a denial of service. It affects
<code>httpcore5-h2</code> 5.4.2 and earlier (and 5.5-beta1 and
+earlier); fixed in 5.4.3.</p>
+<p>Solr is <strong>not affected</strong>.
<code>httpcore5-h2</code> is bundled transitively by
+<code>org.apache.calcite.avatica:avatica-core</code>, which uses
it to support Avatica's <em>optional remote-JDBC</em>
+HTTP/2 transport -- see the companion VEX entry for CVE-2026-64607
(<code>httpclient5</code>) for the full
+reachability analysis, which applies identically here: Solr's
<code>/sql</code> handler never uses Avatica's
+remote HTTP transport, only the local embedded
<code>CalciteConnection</code>, so the HPACK decoder this CVE
+concerns -- which only runs when HttpComponents is actually acting as an
HTTP/2 endpoint -- is never
+invoked. The dependency is <code>permitUnusedDeclared</code> in
Solr's own build and shipped only via the
+optional <code>solr:modules:sql</code> module.</p>
+<p>Solr has shipped an affected <code>httpcore5-h2</code>
since at least 9.1.0 (through 10.0.0, and continuing on
+<code>branch_10x</code>/<code>main</code> at 5.3.4).
<code>branch_9x</code> has since moved to 5.4.3, exactly the fix
version --
+picked up incidentally via routine dependency maintenance, not a targeted fix
for this CVE. Since the
+code path is unreachable regardless, no fix is required on
<code>branch_10x</code>/<code>main</code>
either.</p></content><category
term="solr/vex"/></entry><entry><title>Apache HttpComponents Client: connection
leak on Content-Encoding decode error</title><link href="/cve-2026-64607.html"
rel="alternate"/><published>2026-08-25T00:00:00+00:00</published><updated>2026-08-25T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026 [...]
+(blocking) I/O model: if a response has an invalid or unsupported
<code>Content-Encoding</code> header, the
+client fails to release the underlying connection back to the connection
manager, eventually
+exhausting the pool and causing a denial of service. It
…</p></summary><content type="html"><p>CVE-2026-64607 (medium
severity) is a connection-leak bug in Apache HttpComponents Client's classic
+(blocking) I/O model: if a response has an invalid or unsupported
<code>Content-Encoding</code> header, the
+client fails to release the underlying connection back to the connection
manager, eventually
+exhausting the pool and causing a denial of service. It does not affect
HttpClient's async I/O model.
+It affects <code>httpclient5</code> from 5.0-alpha1 through 5.6.2;
fixed in 5.6.3.</p>
+<p>Solr is <strong>not affected</strong>.
<code>httpclient5</code> (along with
<code>httpcore5</code> and <code>httpcore5-h2</code>,
covered in
+separate VEX entries for their own CVEs) is bundled transitively by
<code>org.apache.calcite.avatica:avatica-core</code>,
+which uses it to support Avatica's <em>optional remote-JDBC</em>
transport -- connecting to a remote Avatica
+server over HTTP. Solr's own <code>/sql</code> handler
(<code>CalciteSolrDriver</code>) only ever opens a local, in-process
+<code>org.apache.calcite.jdbc.CalciteConnection</code>; there is
no
<code>org.apache.hc.client5</code>/<code>org.apache.hc.core5</code>
+usage anywhere in <code>solr/modules/sql</code>'s source, and Solr
never acts as an Avatica HTTP client or server.
+The dependency has in fact been marked
<code>permitUnusedDeclared</code> in Solr's own build since at
least the
+10.0.0 release, confirming the build's own dependency-analysis tooling already
recognized it as
+present-but-unused. It's also shipped only via the optional
<code>solr:modules:sql</code> module -- every other
+place it appears (<code>solrj-streaming</code>,
<code>solr-ref-guide</code>, <code>webapp</code>) is
test-scope only, not shipped.</p>
+<p>Solr has shipped an affected <code>httpclient5</code>
since at least 9.1.0 (through 10.0.0, and continuing on
+<code>branch_10x</code>/<code>main</code> at 5.5).
<code>branch_9x</code> has since moved to 5.6.4, past the fix --
picked up
+incidentally via routine dependency maintenance, not a targeted fix for this
CVE. Since the code path
+is unreachable regardless, no fix is required on
<code>branch_10x</code>/<code>main</code>
either.</p></content><category
term="solr/vex"/></entry><entry><title>Netty: SslHandler native crash on
crafted packets</title><link href="/cve-2025-24970.html"
rel="alternate"/><published>2026-08-23T00:00:00+00:00</published><updated>2026-08-23T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-08-23:/cve-2025-24970.html</id><summar
[...]
<code>netty-tcnative</code>) TLS engine is in use, a specially
crafted packet received during TLS
processing is not properly validated, which can trigger a native crash (JVM
segfault) rather
than a clean exception. It affects Netty
<code>netty-handler</code> versions 4 …</p></summary><content
type="html"><p>CVE-2025-24970 is a flaw in Netty's
<code>SslHandler</code>: when the native (OpenSSL/BoringSSL, via
@@ -1705,18 +1784,4 @@ ship any Struts jar — the dependency is excluded and
only appears as a transit
(see SOLR-2849) — so these Struts vulnerabilities are not present in, or
exploitable through, Solr.</p></content><category
term="solr/vex"/></entry><entry><title>vorbis-java-tika</title><link
href="/cve-2016-6809.html"
rel="alternate"/><published>2022-12-14T00:00:00+00:00</published><updated>2022-12-14T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2022-12-14:/cve-2016-6809.html</id><content
type="html"><p>See https://github.com/Gagravarr/Vo [...]
<p>Tika as an in-process component was removed in Solr
9.11.</p></content><category
term="solr/vex"/></entry><entry><title>org.restlet</title><link
href="/cve-2017-14868.html"
rel="alternate"/><published>2022-12-14T00:00:00+00:00</published><updated>2022-12-14T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2022-12-14:/cve-2017-14868.html</id><content
type="html"><p>Solr should not be exposed outside a firewall where bad
actors can send [...]
<p>All 15 are pre-block-list "individual gadget" CVEs, fixed in
jackson-databind ≤ 2.9.10.7 / ≤ 2.10.5.1 (the latest, CVE-2021-20190, in
2.10.5.1). Solr's <strong>standalone</strong>
<code>jackson-databind</code> — the
<code>jackson-databind-*.jar</code> this statement covers — was
within that range from 4.7.0 through Solr <strong>8.6.3</strong>:
2.9.x up to 8.3.1, then 2.10.0 / 2.10.1 through 8.6.3 (all &lt; 2.10.5.1).
Solr 8.7.0 [...]
-<p>SOLR-17236 tracks this same class of jackson-databind deserialization
CVEs for the old 2.x copy shaded inside Hadoop's
<code>htrace-core4</code> jar in the 8.x line; the same reasoning
applies, and <code>htrace-core4</code> (with its bundled
jackson-databind) was removed in Solr 9.x.</p></content><category
term="solr/vex"/></entry><entry><title>hadoop-auth</title><link
href="/cve-2017-15718.html"
rel="alternate"/><published>2022-12-14T00:00:00+00:00 [...]
-releases up to and including 2.0.6 (fixed in 2.0.6.1). Solr has bundled JDOM
(transitively, via
-Apache Tika / Solr Cell) since Solr 3.6.0 — <code>jdom</code> 1.0,
then <code>jdom</code> 2.0 …</p></summary><content
type="html"><p>CVE-2021-33813 is an XML external entity (XXE) issue in
JDOM's <code>SAXBuilder</code>, affecting all JDOM
-releases up to and including 2.0.6 (fixed in 2.0.6.1). Solr has bundled JDOM
(transitively, via
-Apache Tika / Solr Cell) since Solr 3.6.0 — <code>jdom</code> 1.0,
then <code>jdom</code> 2.0.2, then <code>jdom2</code>
2.0.6 —
-through the last 8.x release; Solr 9.0.0 upgraded to the fixed
<code>jdom2</code> 2.0.6.1. The affected range is
-therefore 3.6.0 – 8.8.1.</p>
-<p>JDOM is only used in Solr Cell, which should not be used in
production which makes the vulnerability unexploitable. It is a dependency of
Apache Tika, which has analyzed the issue and determined the vulnerability is
limited to two libraries not commonly used in search applications, see
TIKA-3488 for details. Since Tika should be used outside of Solr, use a version
of Tika which updates the affected libraries if concerned about exposure to
this issue.</p></content><category [...]
-escape the input filename before passing it to a shell. It affects
<code>hadoop-common</code> 2.0.0–2.10.1,
-3.0.0-alpha–3.2.3 and 3.3.0–3.3.2 (fixed in 2.10.2
…</p></summary><content type="html"><p>CVE-2022-25168 is a
command-injection flaw in Apache Hadoop's
<code>FileUtil.unTar(...)</code>, which fails to
-escape the input filename before passing it to a shell. It affects
<code>hadoop-common</code> 2.0.0–2.10.1,
-3.0.0-alpha–3.2.3 and 3.3.0–3.3.2 (fixed in 2.10.2, 3.2.4 and 3.3.3). Solr has
bundled an affected
-<code>hadoop-common</code> (transitively, for HDFS support) since
Solr 4.4.0, through Solr 9.0.0 (which ships
-3.3.2); Solr 9.1.0 upgraded to the fixed 3.3.4. The affected range is
therefore 4.4.0 – 9.0.0.</p>
-<p>The vulnerable code won't be used by Solr because Solr only is only
using HDFS as a client.</p></content><category
term="solr/vex"/></entry></feed>
\ No newline at end of file
+<p>SOLR-17236 tracks this same class of jackson-databind deserialization
CVEs for the old 2.x copy shaded inside Hadoop's
<code>htrace-core4</code> jar in the 8.x line; the same reasoning
applies, and <code>htrace-core4</code> (with its bundled
jackson-databind) was removed in Solr 9.x.</p></content><category
term="solr/vex"/></entry><entry><title>hadoop-auth</title><link
href="/cve-2017-15718.html"
rel="alternate"/><published>2022-12-14T00:00:00+00:00 [...]
\ No newline at end of file
diff --git a/output/security-dependency-cves.html
b/output/security-dependency-cves.html
index ba1516766..d9630c4f8 100644
--- a/output/security-dependency-cves.html
+++ b/output/security-dependency-cves.html
@@ -191,6 +191,42 @@ or contact <a
href="mailto:[email protected]";>[email protected]</a>.</p>
</tr>
<tr>
<td>
+<a href="https://nvd.nist.gov/vuln/detail/CVE-2026-64607";>CVE-2026-64607</a>
</td>
+ <td>9.1.0-10.0.0</td>
+ <td>
+ httpclient5-5.5.jar </td>
+ <td><span class="cdx-not-affected">not affected</span></td>
+ <td><a href="/vex.html#cve-2026-64607">Apache HttpComponents Client:
connection leak on Content-Encoding decode error</a></td>
+ </tr>
+ <tr>
+ <td>
+<a href="https://nvd.nist.gov/vuln/detail/CVE-2026-54428";>CVE-2026-54428</a>
</td>
+ <td>9.1.0-10.0.0</td>
+ <td>
+ httpcore5-h2-5.3.4.jar </td>
+ <td><span class="cdx-not-affected">not affected</span></td>
+ <td><a href="/vex.html#cve-2026-54428">Apache HttpComponents Core: HPACK
decoder unlimited header list size before SETTINGS ACK</a></td>
+ </tr>
+ <tr>
+ <td>
+<a href="https://nvd.nist.gov/vuln/detail/CVE-2026-54399";>CVE-2026-54399</a>
</td>
+ <td>9.1.0-10.0.0</td>
+ <td>
+ httpcore5-5.3.5.jar </td>
+ <td><span class="cdx-not-affected">not affected</span></td>
+ <td><a href="/vex.html#cve-2026-54399">Apache HttpComponents Core:
HTTP/1 header parsing memory-exhaustion denial of service</a></td>
+ </tr>
+ <tr>
+ <td>
+<a href="https://nvd.nist.gov/vuln/detail/CVE-2026-48779";>CVE-2026-48779</a>
</td>
+ <td>10.0.0</td>
+ <td>
+ ws-8.18.0.tgz </td>
+ <td><span class="cdx-not-affected">not affected</span></td>
+ <td><a href="/vex.html#cve-2026-48779">ws: memory exhaustion denial of
service from tiny WebSocket fragments</a></td>
+ </tr>
+ <tr>
+ <td>
<a href="https://nvd.nist.gov/vuln/detail/CVE-2025-24970";>CVE-2025-24970</a>
</td>
<td>9.3.0-9.9.0</td>
<td>
diff --git a/output/solr.openvex.json b/output/solr.openvex.json
index 64f84263e..d08fc2724 100644
--- a/output/solr.openvex.json
+++ b/output/solr.openvex.json
@@ -2,7 +2,7 @@
"@context": "https://openvex.dev/ns/v0.2.0";,
"@id": "https://solr.apache.org/solr.openvex.json";,
"author": "Apache Solr Project ([email protected])",
- "timestamp": "2026-08-23T00:00:00Z",
+ "timestamp": "2026-08-25T00:00:00Z",
"version": 1,
"statements": [
{
@@ -4352,6 +4352,66 @@
"timestamp": "2026-08-23T00:00:00Z",
"impact_statement": "CVE-2025-24970 is a flaw in Netty's `SslHandler`:
when the native (OpenSSL/BoringSSL, via\n`netty-tcnative`) TLS engine is in
use, a specially crafted packet received during TLS\nprocessing is not properly
validated, which can trigger a native crash (JVM segfault) rather\nthan a clean
exception. It affects Netty `netty-handler` versions 4.1.91.Final
through\n4.1.117.Final; fixed in 4.1.118.Final. The 4.2.x release line is not
in the affected range at\nall \u201 [...]
"status_notes": "Affected Apache Solr versions: 9.3.0-9.9.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2026-48779"
+ },
+ "products": [
+ {
+ "@id": "ws-8.18.0.tgz"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-08-25T00:00:00Z",
+ "justification": "vulnerable_code_not_present",
+ "impact_statement": "CVE-2026-48779 is a memory-exhaustion
denial-of-service issue in the Node.js `ws` WebSocket library:\na peer that
sends a high volume of exceptionally small message fragments can force the
receiving side\nto allocate and retain structural wrappers far larger than the
documented message-size limit,\neventually exhausting memory. It affects `ws`
8.0.0 through 8.20.x; fixed in 8.21.0 (with backports\nto the 5.x/6.x/7.x lines
for older major versions).\n\nSolr is * [...]
+ "status_notes": "Affected Apache Solr versions: 10.0.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2026-54399"
+ },
+ "products": [
+ {
+ "@id": "httpcore5-5.3.5.jar"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-08-25T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "CVE-2026-54399 is an
uncontrolled-resource-consumption issue in Apache HttpComponents Core's
HTTP/1.1\nmessage parser: a remote peer can send messages with an excessive
number of headers or excessive\nheader length, exhausting memory and causing a
denial of service. It affects `httpcore5` 5.4.2 and\nearlier (and 5.5-beta1 and
earlier); fixed in 5.4.3.\n\nSolr is **not affected**. `httpcore5` is bundled
transitively by\n`org.apache.calcite.avatica:avatica-core`, [...]
+ "status_notes": "Affected Apache Solr versions: 9.1.0-10.0.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2026-54428"
+ },
+ "products": [
+ {
+ "@id": "httpcore5-h2-5.3.4.jar"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-08-25T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "CVE-2026-54428 is an allocation-without-limits
issue in Apache HttpComponents Core's HTTP/2 HPACK\ndecoder: before an HTTP/2
peer's `SETTINGS` frame is acknowledged, the configured header list size\nlimit
isn't yet applied, so a remote peer can send oversized compressed header blocks
and exhaust\nmemory, causing a denial of service. It affects `httpcore5-h2`
5.4.2 and earlier (and 5.5-beta1 and\nearlier); fixed in 5.4.3.\n\nSolr is
**not affected**. `httpcore5- [...]
+ "status_notes": "Affected Apache Solr versions: 9.1.0-10.0.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2026-64607"
+ },
+ "products": [
+ {
+ "@id": "httpclient5-5.5.jar"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-08-25T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "CVE-2026-64607 (medium severity) is a
connection-leak bug in Apache HttpComponents Client's classic\n(blocking) I/O
model: if a response has an invalid or unsupported `Content-Encoding` header,
the\nclient fails to release the underlying connection back to the connection
manager, eventually\nexhausting the pool and causing a denial of service. It
does not affect HttpClient's async I/O model.\nIt affects `httpclient5` from
5.0-alpha1 through 5.6.2; fixed in 5.6. [...]
+ "status_notes": "Affected Apache Solr versions: 9.1.0-10.0.0."
}
]
}
\ No newline at end of file
diff --git a/output/solr.vex.json b/output/solr.vex.json
index e75c79ccf..6d1e97d01 100644
--- a/output/solr.vex.json
+++ b/output/solr.vex.json
@@ -7,7 +7,7 @@
"name": "solr",
"version": "SNAPSHOT",
"type": "application",
- "bom-ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "bom-ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
},
"vulnerabilities": [
@@ -23,7 +23,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -39,7 +39,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -55,7 +55,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -71,7 +71,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -87,7 +87,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -103,7 +103,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -119,7 +119,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -135,7 +135,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -151,7 +151,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -167,7 +167,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -183,7 +183,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -199,7 +199,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -215,7 +215,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -231,7 +231,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -247,7 +247,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -263,7 +263,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -279,7 +279,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -295,7 +295,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -311,7 +311,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -327,7 +327,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -343,7 +343,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -359,7 +359,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -375,7 +375,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -391,7 +391,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -407,7 +407,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -423,7 +423,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -439,7 +439,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -455,7 +455,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -471,7 +471,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -487,7 +487,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -503,7 +503,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -519,7 +519,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -535,7 +535,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -551,7 +551,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -567,7 +567,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -583,7 +583,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -599,7 +599,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -615,7 +615,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -631,7 +631,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -647,7 +647,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -663,7 +663,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -679,7 +679,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -695,7 +695,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -711,7 +711,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -727,7 +727,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -743,7 +743,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -759,7 +759,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -775,7 +775,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -791,7 +791,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -807,7 +807,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -823,7 +823,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -839,7 +839,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -855,7 +855,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -871,7 +871,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -887,7 +887,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -903,7 +903,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -919,7 +919,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -935,7 +935,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -951,7 +951,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -970,7 +970,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -986,7 +986,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1002,7 +1002,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1018,7 +1018,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1037,7 +1037,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1053,7 +1053,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1070,7 +1070,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1087,7 +1087,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1104,7 +1104,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1121,7 +1121,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1138,7 +1138,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1155,7 +1155,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1172,7 +1172,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1189,7 +1189,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1206,7 +1206,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1223,7 +1223,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1240,7 +1240,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1257,7 +1257,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1274,7 +1274,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1291,7 +1291,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1308,7 +1308,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1325,7 +1325,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1342,7 +1342,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1359,7 +1359,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1376,7 +1376,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1393,7 +1393,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1410,7 +1410,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1427,7 +1427,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1444,7 +1444,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1464,7 +1464,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1484,7 +1484,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1504,7 +1504,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1521,7 +1521,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1541,7 +1541,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1558,7 +1558,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1575,7 +1575,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1592,7 +1592,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1609,7 +1609,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1626,7 +1626,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1643,7 +1643,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1660,7 +1660,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1677,7 +1677,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1694,7 +1694,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1711,7 +1711,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1728,7 +1728,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1745,7 +1745,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1762,7 +1762,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1779,7 +1779,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1796,7 +1796,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1813,7 +1813,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1830,7 +1830,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1847,7 +1847,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1864,7 +1864,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1881,7 +1881,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1898,7 +1898,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1915,7 +1915,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1932,7 +1932,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1949,7 +1949,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1966,7 +1966,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -1983,7 +1983,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -2000,7 +2000,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -2017,7 +2017,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -2034,7 +2034,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -2051,7 +2051,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -2068,7 +2068,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -2085,7 +2085,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -2102,7 +2102,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -2119,7 +2119,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -2136,7 +2136,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -2153,7 +2153,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -2170,7 +2170,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -2187,7 +2187,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -2204,7 +2204,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -2221,7 +2221,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -2238,7 +2238,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -2255,7 +2255,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -2272,7 +2272,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -2289,7 +2289,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -2306,7 +2306,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -2323,7 +2323,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -2340,7 +2340,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -2357,7 +2357,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -2374,7 +2374,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -2391,7 +2391,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -2408,7 +2408,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -2425,7 +2425,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -2442,7 +2442,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -2459,7 +2459,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -2476,7 +2476,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -2493,7 +2493,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -2510,7 +2510,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -2529,7 +2529,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -2546,7 +2546,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -2563,7 +2563,7 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
},
@@ -2580,7 +2580,75 @@
},
"affects": [
{
- "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
+ }
+ ]
+ },
+ {
+ "id": "CVE-2026-48779",
+ "source": {
+ "name": "NVD",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48779";
+ },
+ "analysis": {
+ "state": "not_affected",
+ "justification": "code_not_present",
+ "detail": "CVE-2026-48779 is a memory-exhaustion denial-of-service
issue in the Node.js `ws` WebSocket library:\na peer that sends a high volume
of exceptionally small message fragments can force the receiving side\nto
allocate and retain structural wrappers far larger than the documented
message-size limit,\neventually exhausting memory. It affects `ws` 8.0.0
through 8.20.x; fixed in 8.21.0 (with backports\nto the 5.x/6.x/7.x lines for
older major versions).\n\nSolr is **not aff [...]
+ },
+ "affects": [
+ {
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
+ }
+ ]
+ },
+ {
+ "id": "CVE-2026-54399",
+ "source": {
+ "name": "NVD",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399";
+ },
+ "analysis": {
+ "state": "not_affected",
+ "justification": "code_not_reachable",
+ "detail": "CVE-2026-54399 is an uncontrolled-resource-consumption
issue in Apache HttpComponents Core's HTTP/1.1\nmessage parser: a remote peer
can send messages with an excessive number of headers or excessive\nheader
length, exhausting memory and causing a denial of service. It affects
`httpcore5` 5.4.2 and\nearlier (and 5.5-beta1 and earlier); fixed in
5.4.3.\n\nSolr is **not affected**. `httpcore5` is bundled transitively
by\n`org.apache.calcite.avatica:avatica-core`, which u [...]
+ },
+ "affects": [
+ {
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
+ }
+ ]
+ },
+ {
+ "id": "CVE-2026-54428",
+ "source": {
+ "name": "NVD",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428";
+ },
+ "analysis": {
+ "state": "not_affected",
+ "justification": "code_not_reachable",
+ "detail": "CVE-2026-54428 is an allocation-without-limits issue in
Apache HttpComponents Core's HTTP/2 HPACK\ndecoder: before an HTTP/2 peer's
`SETTINGS` frame is acknowledged, the configured header list size\nlimit isn't
yet applied, so a remote peer can send oversized compressed header blocks and
exhaust\nmemory, causing a denial of service. It affects `httpcore5-h2` 5.4.2
and earlier (and 5.5-beta1 and\nearlier); fixed in 5.4.3.\n\nSolr is **not
affected**. `httpcore5-h2` is b [...]
+ },
+ "affects": [
+ {
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
+ }
+ ]
+ },
+ {
+ "id": "CVE-2026-64607",
+ "source": {
+ "name": "NVD",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607";
+ },
+ "analysis": {
+ "state": "not_affected",
+ "justification": "code_not_reachable",
+ "detail": "CVE-2026-64607 (medium severity) is a connection-leak bug
in Apache HttpComponents Client's classic\n(blocking) I/O model: if a response
has an invalid or unsupported `Content-Encoding` header, the\nclient fails to
release the underlying connection back to the connection manager,
eventually\nexhausting the pool and causing a denial of service. It does not
affect HttpClient's async I/O model.\nIt affects `httpclient5` from 5.0-alpha1
through 5.6.2; fixed in 5.6.3.\n\nSo [...]
+ },
+ "affects": [
+ {
+ "ref": "d37e76c9-d410-5cb1-82a1-e9fda42daf1f"
}
]
}
diff --git a/output/vex.html b/output/vex.html
index e7c86edb4..d0df75e95 100644
--- a/output/vex.html
+++ b/output/vex.html
@@ -142,6 +142,153 @@
<h1>Apache Solr VEX</h1>
<p><a href="/security-dependency-cves.html">← Back to the dependency
CVE table</a></p>
+ <article id="cve-2026-64607" class="post panel radius">
+ <header class="post-header">
+ <h3 class="title"><a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-64607";>CVE-2026-64607</a>,
Apache HttpComponents Client: connection leak on Content-Encoding decode
error</h3>
+ <div class="panel callout">
+ <p class="subheader">
+ <strong>Status:</strong>
+ <span class="cdx-not-affected">not_affected</span>
+ </p>
+ <p class="subheader"><strong>Affected Solr
versions:</strong> 9.1.0-10.0.0</p>
+ </div>
+ </header>
+
+ <h4>Description</h4>
+ <p>CVE-2026-64607 (medium severity) is a connection-leak bug
in Apache HttpComponents Client's classic
+(blocking) I/O model: if a response has an invalid or unsupported
<code>Content-Encoding</code> header, the
+client fails to release the underlying connection back to the connection
manager, eventually
+exhausting the pool and causing a denial of service. It does not affect
HttpClient's async I/O model.
+It affects <code>httpclient5</code> from 5.0-alpha1 through 5.6.2; fixed in
5.6.3.</p>
+<p>Solr is <strong>not affected</strong>. <code>httpclient5</code> (along with
<code>httpcore5</code> and <code>httpcore5-h2</code>, covered in
+separate VEX entries for their own CVEs) is bundled transitively by
<code>org.apache.calcite.avatica:avatica-core</code>,
+which uses it to support Avatica's <em>optional remote-JDBC</em> transport --
connecting to a remote Avatica
+server over HTTP. Solr's own <code>/sql</code> handler
(<code>CalciteSolrDriver</code>) only ever opens a local, in-process
+<code>org.apache.calcite.jdbc.CalciteConnection</code>; there is no
<code>org.apache.hc.client5</code>/<code>org.apache.hc.core5</code>
+usage anywhere in <code>solr/modules/sql</code>'s source, and Solr never acts
as an Avatica HTTP client or server.
+The dependency has in fact been marked <code>permitUnusedDeclared</code> in
Solr's own build since at least the
+10.0.0 release, confirming the build's own dependency-analysis tooling already
recognized it as
+present-but-unused. It's also shipped only via the optional
<code>solr:modules:sql</code> module -- every other
+place it appears (<code>solrj-streaming</code>, <code>solr-ref-guide</code>,
<code>webapp</code>) is test-scope only, not shipped.</p>
+<p>Solr has shipped an affected <code>httpclient5</code> since at least 9.1.0
(through 10.0.0, and continuing on
+<code>branch_10x</code>/<code>main</code> at 5.5). <code>branch_9x</code> has
since moved to 5.6.4, past the fix -- picked up
+incidentally via routine dependency maintenance, not a targeted fix for this
CVE. Since the code path
+is unreachable regardless, no fix is required on
<code>branch_10x</code>/<code>main</code> either.</p>
+
+ <h4>References</h4>
+ <ul>
+ <li>CVE: <a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-64607";>CVE-2026-64607</a></li>
+ </ul>
+ </article>
+ <article id="cve-2026-54428" class="post panel radius">
+ <header class="post-header">
+ <h3 class="title"><a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-54428";>CVE-2026-54428</a>,
Apache HttpComponents Core: HPACK decoder unlimited header list size before
SETTINGS ACK</h3>
+ <div class="panel callout">
+ <p class="subheader">
+ <strong>Status:</strong>
+ <span class="cdx-not-affected">not_affected</span>
+ </p>
+ <p class="subheader"><strong>Affected Solr
versions:</strong> 9.1.0-10.0.0</p>
+ </div>
+ </header>
+
+ <h4>Description</h4>
+ <p>CVE-2026-54428 is an allocation-without-limits issue in
Apache HttpComponents Core's HTTP/2 HPACK
+decoder: before an HTTP/2 peer's <code>SETTINGS</code> frame is acknowledged,
the configured header list size
+limit isn't yet applied, so a remote peer can send oversized compressed header
blocks and exhaust
+memory, causing a denial of service. It affects <code>httpcore5-h2</code>
5.4.2 and earlier (and 5.5-beta1 and
+earlier); fixed in 5.4.3.</p>
+<p>Solr is <strong>not affected</strong>. <code>httpcore5-h2</code> is bundled
transitively by
+<code>org.apache.calcite.avatica:avatica-core</code>, which uses it to support
Avatica's <em>optional remote-JDBC</em>
+HTTP/2 transport -- see the companion VEX entry for CVE-2026-64607
(<code>httpclient5</code>) for the full
+reachability analysis, which applies identically here: Solr's
<code>/sql</code> handler never uses Avatica's
+remote HTTP transport, only the local embedded <code>CalciteConnection</code>,
so the HPACK decoder this CVE
+concerns -- which only runs when HttpComponents is actually acting as an
HTTP/2 endpoint -- is never
+invoked. The dependency is <code>permitUnusedDeclared</code> in Solr's own
build and shipped only via the
+optional <code>solr:modules:sql</code> module.</p>
+<p>Solr has shipped an affected <code>httpcore5-h2</code> since at least 9.1.0
(through 10.0.0, and continuing on
+<code>branch_10x</code>/<code>main</code> at 5.3.4). <code>branch_9x</code>
has since moved to 5.4.3, exactly the fix version --
+picked up incidentally via routine dependency maintenance, not a targeted fix
for this CVE. Since the
+code path is unreachable regardless, no fix is required on
<code>branch_10x</code>/<code>main</code> either.</p>
+
+ <h4>References</h4>
+ <ul>
+ <li>CVE: <a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-54428";>CVE-2026-54428</a></li>
+ </ul>
+ </article>
+ <article id="cve-2026-54399" class="post panel radius">
+ <header class="post-header">
+ <h3 class="title"><a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-54399";>CVE-2026-54399</a>,
Apache HttpComponents Core: HTTP/1 header parsing memory-exhaustion denial of
service</h3>
+ <div class="panel callout">
+ <p class="subheader">
+ <strong>Status:</strong>
+ <span class="cdx-not-affected">not_affected</span>
+ </p>
+ <p class="subheader"><strong>Affected Solr
versions:</strong> 9.1.0-10.0.0</p>
+ </div>
+ </header>
+
+ <h4>Description</h4>
+ <p>CVE-2026-54399 is an uncontrolled-resource-consumption
issue in Apache HttpComponents Core's HTTP/1.1
+message parser: a remote peer can send messages with an excessive number of
headers or excessive
+header length, exhausting memory and causing a denial of service. It affects
<code>httpcore5</code> 5.4.2 and
+earlier (and 5.5-beta1 and earlier); fixed in 5.4.3.</p>
+<p>Solr is <strong>not affected</strong>. <code>httpcore5</code> is bundled
transitively by
+<code>org.apache.calcite.avatica:avatica-core</code>, which uses it to support
Avatica's <em>optional remote-JDBC</em>
+HTTP transport -- see the companion VEX entry for CVE-2026-64607
(<code>httpclient5</code>) for the full
+reachability analysis, which applies identically here: Solr's
<code>/sql</code> handler never uses Avatica's
+remote HTTP transport, only the local embedded <code>CalciteConnection</code>,
so <code>httpcore5</code>'s HTTP/1.1 message
+parser is never invoked to process any inbound message, trusted or otherwise.
The dependency is
+<code>permitUnusedDeclared</code> in Solr's own build and shipped only via the
optional <code>solr:modules:sql</code>
+module.</p>
+<p>Solr has shipped an affected <code>httpcore5</code> since at least 9.1.0
(through 10.0.0, and continuing on
+<code>branch_10x</code>/<code>main</code> at 5.3.5). <code>branch_9x</code>
has since moved to 5.4.3, exactly the fix version --
+picked up incidentally via routine dependency maintenance, not a targeted fix
for this CVE. Since the
+code path is unreachable regardless, no fix is required on
<code>branch_10x</code>/<code>main</code> either.</p>
+
+ <h4>References</h4>
+ <ul>
+ <li>CVE: <a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-54399";>CVE-2026-54399</a></li>
+ </ul>
+ </article>
+ <article id="cve-2026-48779" class="post panel radius">
+ <header class="post-header">
+ <h3 class="title"><a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-48779";>CVE-2026-48779</a>, ws:
memory exhaustion denial of service from tiny WebSocket fragments</h3>
+ <div class="panel callout">
+ <p class="subheader">
+ <strong>Status:</strong>
+ <span class="cdx-not-affected">not_affected</span>
+ </p>
+ <p class="subheader"><strong>Affected Solr
versions:</strong> 10.0.0</p>
+ </div>
+ </header>
+
+ <h4>Description</h4>
+ <p>CVE-2026-48779 is a memory-exhaustion denial-of-service
issue in the Node.js <code>ws</code> WebSocket library:
+a peer that sends a high volume of exceptionally small message fragments can
force the receiving side
+to allocate and retain structural wrappers far larger than the documented
message-size limit,
+eventually exhausting memory. It affects <code>ws</code> 8.0.0 through 8.20.x;
fixed in 8.21.0 (with backports
+to the 5.x/6.x/7.x lines for older major versions).</p>
+<p>Solr is <strong>not affected</strong>. <code>ws</code> is pinned in
<code>kotlin-js-store/wasm/yarn.lock</code>, an auto-generated
+lockfile for the Kotlin/Wasm build toolchain that compiles the new
Compose-based Admin UI
+(<code>solr/ui</code>). It is a transitive dependency of that toolchain's
Node.js-based dev-server/test-runner
+tooling, not of Solr's own code. <code>ws</code> depends on Node.js's native
TCP socket APIs, which don't exist
+in a browser sandbox -- it is therefore not possible for it to be bundled into
the actual
+browser-executable Wasm/JS output that ships to end users and runs in their
browser. This isn't a
+case of unreachable-but-present code; the vulnerable component is never part
of the shipped product
+artifact at all, only of the build/test pipeline that produces it.</p>
+<p><code>ws</code> has been present in <code>solr/ui</code>'s build tooling
since it was first introduced (shipped in the
+10.0.0 release at <code>[email protected]</code>/<code>[email protected]</code>, both within
the affected range). <code>branch_9x</code> doesn't have
+this module at all. Since this dependency never reaches a shipped artifact, no
application-level fix
+is required; bumping it is worth doing as routine build-tooling hygiene
regardless, since a compromised
+or misbehaving local/CI dev-server dependency is still worth avoiding even
without direct product
+exposure.</p>
+
+ <h4>References</h4>
+ <ul>
+ <li>CVE: <a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-48779";>CVE-2026-48779</a></li>
+ </ul>
+ </article>
<article id="cve-2025-24970" class="post panel radius">
<header class="post-header">
<h3 class="title"><a
href="https://nvd.nist.gov/vuln/detail/CVE-2025-24970";>CVE-2025-24970</a>,
Netty: SslHandler native crash on crafted packets</h3>
