Hi Michael, There is no Log4j 2.26.4: you probably meant 2.25.4.
The latest Log4j 2 release is 2.26.1 (June 2026), and recent Solr versions already ship it: * Solr 9.11.0: Log4j 2.26.1 * Solr 10.1.0 (release vote in progress): Log4j 2.26.1 * Solr 9.10.1 and 10.0.0: Log4j 2.25.3 If your scanner flags Log4j in Solr 9.10.1 or 10.0.0, it is most likely reporting CVE-2026-34477, CVE-2026-34478, CVE-2026-34479, CVE-2026-34480 or CVE-2026-34481. The Solr project has analysed all of them in its VEX statements [1]: none of them is exploitable with the logging configuration shipped with Solr. They all require either a non-default appender or layout (TLS Socket/SMTP/Syslog appenders, Rfc5424Layout, XmlLayout, Log4j1XmlLayout) or application code that Solr doesn't have. Your scanner may also report CVE-2026-49844 (log4j-api, fixed in 2.25.5 and 2.26.1) against 2.25.3. Speaking as a member of the Logging PMC, it requires logging a MapMessage with an attacker-controlled floating-point value, and, as explained in the VEX entry for CVE-2026-34481, nothing in the Solr distribution logs MapMessages. I can add a VEX entry for it. The simplest way to make the warnings go away is to upgrade to Solr 9.11.0. If your scanner reports a different CVE, please let us know the identifier and the Solr version you are running. [1] https://solr.apache.org/vex.html Piotr On 2026-09-21T12:44:45Z, Michael Schulpen wrote: > Could you please do an upgrade to log4j version 2.26.4 > > Because al other version has vulnerabilities registered. > > Michael Schulpen > Systeembeheer > > [Infomedics] > > www.infomedics.nl<https://www.infomedics.nl/> > > Dit bericht is uitsluitend bestemd voor de geadresseerde[n]. Het > bericht kan persoonlijke of vertrouwelijke informatie bevatten. Indien > u niet de beoogde geadresseerde bent, is gebruik, openbaarmaking, > vermenigvuldiging, verspreiding en/of verstrekking van deze informatie > aan derden niet toegestaan. In dat geval verzoeken wij u vriendelijk om > het origineel te vernietigen en de afzender hierover te informeren > > --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
