Leszek created SOLR-18392:
-----------------------------
Summary: Upgrade org.apache.opennlp:opennlp-tools to 2.5.9 or
later to remediate CVE-2026-42440
Key: SOLR-18392
URL: https://issues.apache.org/jira/browse/SOLR-18392
Project: Solr
Issue Type: Bug
Security Level: Public (Default Security Level. Issues are Public)
Components: Server
Affects Versions: 10.0
Environment: OS: Linux, Windows, macOS
Solr Version: 10.0.0
Java: 11+
Maven: 3.6+
Reporter: Leszek
h3. Summary
Solr 10.0.0 currently includes {{opennlp-tools}} version 2.5.6, which is
vulnerable to CVE-2026-42440. This vulnerability is remediated in versions >=
2.5.9. This ticket tracks the upgrade of the OpenNLP libraries to patch the
vulnerability.
h3. Current State
* Solr 10.0.0 includes {{opennlp-tools}} version 2.5.6
* This version is vulnerable to CVE-2026-42440
* The vulnerability is fixed in versions >= 2.5.9
* OpenNLP is used across multiple Solr modules:
** {{modules/analysis-extras/lib/}} — NLP-based text analysis and tokenization
** {{modules/langid/lib/}} — Language identification
** {{modules/extraction/lib/}} — Document content extraction
h3. Required Changes
# Update {{opennlp-tools}} dependency from 2.5.6 to 2.5.9 or later
# Update {{opennlp-dl}} dependency to the corresponding version (currently
2.5.6)
Note: {{opennlp-dl}} is the companion library providing pre-trained NLP models.
Version mismatch between tools and models can cause runtime failures due to API
incompatibilities or format changes.
h3. Verification Requirements
Before merging the upgrade, verify compatibility across all affected modules:
h4. API Compatibility
* Confirm that {{{}analysis-extras{}}}, {{{}langid{}}}, and {{extraction}}
modules work with the new OpenNLP APIs
* Test any NLP processing behavioral changes between 2.5.6 and 2.5.9
* Verify that existing Solr configurations continue to function correctly
h4. Testing Scope
* Unit tests for modules using OpenNLP
* Integration tests with sample NLP-intensive workloads
* Compatibility validation across all affected modules
h3. Related Issues
* CVE-2026-42440: Vulnerability in org.apache.opennlp:opennlp-tools < 2.5.9
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
