epugh opened a new pull request, #228: URL: https://github.com/apache/solr-site/pull/228
The three lz4-java CVEs were bundled in a single entry with one range, but **CVE-2026-59949 has a different fix boundary** than the SOLR-18013 pair, so they need to be separated (per the version-range-driven split convention). | CVE | fixed in lz4-java | released 9.8.0–10.0.0 (1.8.0) | dev branches (fork 1.10.1) | |---|---|:--:|:--:| | CVE-2025-12183 | 1.8.1 | affected | **fixed** | | CVE-2025-66566 | 1.10.1 | affected | **fixed** | | CVE-2026-59949 | 1.11.1 | affected | **still affected** (1.10.1 < 1.11.1) | So: - **New `2026-08-13-cve-2025-12183.md`** — CVE-2025-12183 + CVE-2025-66566, `versions: "9.8.0-10.0.0"`. Both fixed by the `branch_9x`/`branch_10x`/`main` migration to the community fork `at.yawk.lz4:lz4-java` 1.10.1, so 9.11/10.1 won't be affected. (This upgrade didn't require Kafka to update first — Solr replaced Kafka's transitive `org.lz4:lz4-java` with the fork directly.) - **`2026-07-31-cve-2026-59949.md`** — reduced to CVE-2026-59949 alone. It needs lz4-java **1.11.1**, which is on *no* branch yet (all three dev branches are on 1.10.1), so 9.11/10.1 will still bundle an affected version and the range will need to extend once they ship. Also adds `org.lz4:lz4-java` (9.8.0–10.0.0 → 1.8.0) to `solr-dependency-versions.json` so both entries now emit a matchable `pkg:maven/org.lz4/[email protected]` product purl instead of a bare, unmatchable id. lz4-java first shipped in Solr **9.8.0** (via the `cross-dc` module); ≤9.7.0 and 8.x ship none. Disposition stays `not_affected` (reachable only through the optional cross-dc Kafka client, never from untrusted input). Site builds, all three statements emit the correct purl, `vexctl merge` passes. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
