epugh commented on code in PR #206: URL: https://github.com/apache/solr-site/pull/206#discussion_r3610673563
########## content/solr/vex/2026-07-18-cve-2026-42577.md: ########## @@ -0,0 +1,48 @@ +--- +cve: CVE-2026-42577 +category: + - solr/vex +versions: "9.10.x,10.0.x" +jars: + - netty-transport-native-epoll-4.2.6.Final.jar +analysis: + state: not_affected + justification: code_not_reachable +title: "Netty: Epoll transport CPU busy-loop DoS via unclosed half-closed connections" +--- +CVE-2026-42577 (CVSS 7.5, CWE-772) is a resource-leak / denial-of-service issue in Netty's Epoll +native transport: a TCP connection that receives a RST after being half-closed isn't properly +closed, so stale channels accumulate and can eventually pin the owning event-loop thread at 100% +CPU. It affects Netty 4.2.0.Final up to (but not including) 4.2.13.Final — the Epoll transport code +in question was introduced by the 4.2 rewrite, so the older 4.1.x line is unaffected regardless of +patch version. It is fixed in 4.2.13.Final. + +Solr shipped Netty 4.1.x from 9.2.0 through 9.9.0, entirely outside this CVE's affected range, so +those releases aren't relevant here. Starting with 9.10.0 (and 10.0.0), Solr moved to Netty +4.2.6.Final, which does fall in the vulnerable range, and dependency scanners flag +`netty-transport-native-epoll-4.2.6.Final.jar` (classifier `linux-x86_64`) on the classpath. +Notably, this jar doesn't come from Solr's OTLP/gRPC export path at all — `grpc-netty`'s own POM +only pulls in `netty-transport-native-unix-common`, never the Epoll transport. It's a transitive dependency of **Apache ZooKeeper**'s client library +(`org.apache.zookeeper:zookeeper`), which optionally supports a Netty-based connection socket for +both its client and server roles. Solr is **not affected**: Review Comment: So, is this statement "solr not affected" correct, except that if someone choooses " to use a SSL/TLS based ZooKeeper connections and follows ZooKeeper instructions to do so, then Netty will be used."? I am looking more into the code to see if that is the case... i.e, i fyou configure zk that way, does it all work in solr. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
