Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.solr:solr-core

31 known vulnerabilities (8 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release
10.1.0 (Oct 27, 2026): no advisory affects it
Newest unaffected release
10.1.0 (Oct 27, 2026), the latest release
Advisories
31 · 8 high, 3 medium
Dependents
19
Releases
130 since 1.3.0 (Sep 17, 2008)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-44825
    Affects 9.4.0 to 9.10.1 (9.11.0 is outside it); 10.0.0 (10.1.0 is outside it)
  • CVE-2026-22022
    Affects 5.3.0 to 9.10.0 (9.10.1 is outside it)
  • CVE-2026-22444
    Affects 8.6.0 to 9.10.0 (9.10.1 is outside it)
  • CVE-2025-24814
    Affects 1.3.0 to 9.7.0 (9.8.0 is outside it)
  • CVE-2024-52012
    Affects 6.6.0 to 9.7.0 (9.8.0 is outside it)
  • CVE-2023-50291
    Affects 6.0.0 to 8.11.2 (8.11.3 is outside it); 9.0.0 to 9.2.1 (9.3.0 is outside it)
  • CVE-2023-50292
    Affects 8.10.0 to 8.11.2 (8.11.3 is outside it); 9.0.0 to 9.2.1 (9.3.0 is outside it)
  • CVE-2023-50386
    Affects 6.0.0 to 8.11.2 (8.11.3 is outside it); 9.0.0 to 9.4.0 (9.4.1 is outside it)
  • CVE-2023-50290
    Affects 9.0.0 to 9.2.1 (9.3.0 is outside it)
  • CVE-2021-29262
    Affects 1.3.0 to 8.8.1 (8.8.2 is outside it)
  • CVE-2020-13957
    Affects 6.6.0 to 8.6.2 (8.6.3 is outside it)
  • CVE-2018-11802
    Affects 1.3.0 to 6.6.5 (6.6.6 is outside it); 7.0.0 to 7.6.0 (7.7.0 is outside it)
Show all 31 advisoriesShow fewer advisories
  • CVE-2019-17558
    Affects 5.0.0 to 8.3.1 (8.4.0 is outside it)
  • CVE-2019-12409
    Affects 8.1.1 to 8.2.0 (8.3.0 is outside it)
  • CVE-2019-12401
    Affects 1.3.0 to 4.10.4 (5.0.0 is outside it)
  • CVE-2019-0193
    Affects 1.3.0 to 8.1.1 (8.2.0 is outside it)
  • CVE-2017-3164
    Affects 1.3.0 to 7.6.0 (7.7.0 is outside it)
  • CVE-2019-0192
    Affects 5.0.0 to 6.6.6 (7.0.0 is outside it)
  • CVE-2018-8026
    Affects 6.0.0 to 6.6.4 (6.6.5 is outside it); 7.0.0 to 7.3.1 (7.4.0 is outside it)
  • CVE-2018-8010
    Affects 6.6.0 to 6.6.3 (6.6.4 is outside it); 7.0.0 to 7.3.0 (7.3.1 is outside it)
  • CVE-2018-1308
    Affects 1.3.0 to 6.6.2 (6.6.3 is outside it); 7.0.0 to 7.2.1 (7.3.0 is outside it)
  • CVE-2017-12629
    Affects 5.5.0 to 5.5.4 (5.5.5 is outside it); 6.0.0 to 6.6.1 (6.6.2 is outside it); 7.0.0 to 7.0.1 (7.1.0 is outside it)
  • CVE-2017-9803
    Affects 6.2.0 to 6.6.0 (6.6.1 is outside it)
  • CVE-2017-3163
    Affects 1.3.0 to 5.5.3 (5.5.4 is outside it); 6.0.0 to 6.4.0 (6.4.1 is outside it)
  • CVE-2017-7660
    Affects 5.3.0 to 5.5.4 (5.5.5 is outside it); 6.0.0 to 6.5.1 (6.6.0 is outside it)
  • CVE-2015-8797
    Affects 1.3.0 to 5.3.0 (5.3.1 is outside it)
  • CVE-2015-8795
    Affects 1.3.0 to 5.0.0 (5.1.0 is outside it)
  • CVE-2012-6612
    Affects 1.3.0 to 4.0.0 (4.1.0 is outside it)
  • CVE-2013-6408
    Affects 1.3.0 to 4.3.0 (4.3.1 is outside it)
  • CVE-2013-6407
    Affects 1.3.0 to 4.0.0 (4.1.0 is outside it)
  • CVE-2013-6397
    Affects 1.3.0 to 4.5.1 (4.6.0 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 31

  • Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users

    Affected: from 9.4.0, through 9.10.1; from 9.4.0, through 9.10.1; versions 10.0.0.

    Fixed in 10.1.0 (released Oct 27, 2026, 148 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 10.1.0, is not affected.

  • Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin

    Affected: from 5.3.0, fixed in 9.10.1.

    Fixed in 9.10.1 (released Jan 20, 2026, 1 day before disclosure).

    The latest release, 10.1.0, is not affected.

  • Apache Solr: Insufficient file-access checking in standalone core-creation requests

    Affected: from 8.6.0, fixed in 9.10.1.

    Fixed in 9.10.1 (released Jan 20, 2026, 1 day before disclosure).

    The latest release, 10.1.0, is not affected.

  • CVE-2025-24814Medium 5.4

    Apache Solr: Core-creation with "trusted" configset can use arbitrary untrusted files

    Affected: fixed in 9.8.0.

    Fixed in 9.8.0 (released Jan 21, 2025, 6 days before disclosure).

    The latest release, 10.1.0, is not affected.

  • CVE-2024-52012Medium 5.4

    Apache Solr: Configset upload on Windows allows arbitrary path write-access

    Affected: from 6.6, fixed in 9.8.0.

    Fixed in 9.8.0 (released Jan 21, 2025, 6 days before disclosure).

    The latest release, 10.1.0, is not affected.

  • Apache Solr: System Property redaction logic inconsistency can lead to leaked passwords

    Affected: from 6.0.0, fixed in 8.11.3; from 9.0.0, fixed in 9.3.0.

    Fixed in 8.11.3 (released Feb 8, 2024, 1 day before disclosure) and 9.3.0 (released Jul 21, 2023, 203 days before disclosure).

    The latest release, 10.1.0, is not affected.

  • Apache Solr: Solr Schema Designer blindly "trusts" all configsets, possibly leading to RCE by unauthenticated users

    Affected: from 9.0.0, fixed in 9.3.0; from 8.10.0, fixed in 8.11.3.

    Fixed in 8.11.3 (released Feb 8, 2024, 1 day before disclosure) and 9.3.0 (released Jul 21, 2023, 203 days before disclosure).

    The latest release, 10.1.0, is not affected.

  • Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets

    Affected: from 6.0.0, fixed in 8.11.3; from 9.0.0, fixed in 9.4.1.

    Fixed in 8.11.3 (released Feb 8, 2024, 1 day before disclosure) and 9.4.1 (released Jan 18, 2024, 22 days before disclosure).

    The latest release, 10.1.0, is not affected.

  • CVE-2023-50290Medium 6.5

    Apache Solr: Host environment variables are published via the Metrics API

    Affected: from 9.0.0, fixed in 9.3.0.

    Fixed in 9.3.0 (released Jul 21, 2023, 178 days before disclosure).

    The latest release, 10.1.0, is not affected.

  • Misapplied Zookeeper ACLs can result in leakage of configured authentication and authorization settings

    Affected: fixed in 8.8.2.

    Fixed in 8.8.2 (released Apr 12, 2021, 1 day before disclosure).

    The latest release, 10.1.0, is not affected.

  • Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used…

    Affected: from 6.6.0, fixed in 8.6.3.

    Fixed in 8.6.3 (released Oct 7, 2020, 6 days before disclosure).

    The latest release, 10.1.0, is not affected.

  • In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection.

    Affected: from 7.0.0, fixed in 7.7.0; fixed in 6.6.6.

    Fixed in 6.6.6 (released Apr 1, 2019, 366 days before disclosure) and 7.7.0 (released Feb 8, 2019, 418 days before disclosure).

    The latest release, 10.1.0, is not affected.

  • CVE-2019-17558High 7.5 · KEV

    Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter.

    Affected: from 5.0.0, fixed in 8.4.0; from 6.0.0, fixed in 8.4.0; from 7.0.0, fixed in 8.4.0; from 8.0.0, fixed in 8.4.0.

    Fixed in 8.4.0 (released Dec 28, 2019, 2 days before disclosure).

    The latest release, 10.1.0, is not affected.

  • The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default…

    Affected: from 8.1.1, fixed in 8.3.0.

    Fixed in 8.3.0 (released Oct 31, 2019, 18 days before disclosure).

    The latest release, 10.1.0, is not affected.

  • Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack (a.k.a.

    Affected: fixed in 5.0.0.

    Fixed in 5.0.0 (released Feb 19, 2015, 1664 days before disclosure).

    The latest release, 10.1.0, is not affected.

Show all 31 advisoriesShow fewer advisories
  • CVE-2019-0193High 7.2 · KEV

    In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in whi

    Affected: fixed in 8.2.0.

    Fixed in 8.2.0 (released Jul 25, 2019, 7 days before disclosure).

    The latest release, 10.1.0, is not affected.

  • Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive).

    Affected: from 1.3.0, fixed in 7.7.0.

    Fixed in 7.7.0 (released Feb 8, 2019, 28 days before disclosure).

    The latest release, 10.1.0, is not affected.

  • In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request.

    Affected: from 5.0.0, fixed in 7.0.0; from 6.0.0, fixed in 7.0.0.

    Fixed in 7.0.0 (released Sep 19, 2017, 534 days before disclosure).

    The latest release, 10.1.0, is not affected.

  • This vulnerability in Apache Solr 6.0.0 to 6.6.4 and 7.0.0 to 7.3.1 relates to an XML external entity expansion (XXE) in Solr config files…

    Affected: from 7.0.0, fixed in 7.4.0; from 6.0.0, fixed in 6.6.5.

    Fixed in 6.6.5 (released Jul 2, 2018, 3 days before disclosure) and 7.4.0 (released Jun 22, 2018, 13 days before disclosure).

    The latest release, 10.1.0, is not affected.

  • This vulnerability in Apache Solr 6.0.0 to 6.6.3, 7.0.0 to 7.3.0 relates to an XML external entity expansion (XXE) in Solr config files…

    Affected: from 6.6.0, fixed in 6.6.4; from 7.0.0, fixed in 7.3.1.

    Fixed in 6.6.4 (released May 17, 2018, 4 days before disclosure) and 7.3.1 (released May 14, 2018, 7 days before disclosure).

    The latest release, 10.1.0, is not affected.

  • This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the…

    Affected: from 1.2, fixed in 6.6.3; from 7.0.0, fixed in 7.3.0.

    Fixed in 6.6.3 (released Mar 6, 2018, 34 days before disclosure) and 7.3.0 (released Apr 4, 2018, 5 days before disclosure).

    The latest release, 10.1.0, is not affected.

  • Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config…

    Affected: from 7.0.0, fixed in 7.1.0; from 6.0.0, fixed in 6.6.2; from 5.5.0, fixed in 5.5.5.

    Fixed in 5.5.5 (released Oct 23, 2017, 9 days after disclosure), 6.6.2 (released Oct 17, 2017, 3 days after disclosure) and 7.1.0 (released Oct 16, 2017, 2 days after disclosure).

    The latest release, 10.1.0, is not affected.

  • Apache Solr's Kerberos plugin can be configured to use delegation tokens, which allows an application to reuse the authentication of an…

    Affected: from 6.2.0, fixed in 6.6.1.

    Fixed in 6.6.1 (released Sep 5, 2017, 13 days before disclosure).

    The latest release, 10.1.0, is not affected.

  • When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts…

    Affected: fixed in 5.5.4; from 6.0.0, fixed in 6.4.1.

    Fixed in 5.5.4 (released Feb 14, 2017, 197 days before disclosure) and 6.4.1 (released Feb 4, 2017, 207 days before disclosure).

    The latest release, 10.1.0, is not affected.

  • Apache Solr uses a PKI based mechanism to secure inter-node communication when security is enabled.

    Affected: from 5.3.0, fixed in 5.5.5; from 6.0.0, fixed in 6.6.0.

    Fixed in 5.5.5 (released Oct 23, 2017, 108 days after disclosure) and 6.6.0 (released Jun 5, 2017, 32 days before disclosure).

    The latest release, 10.1.0, is not affected.

  • Cross-site scripting (XSS) vulnerability in webapp/web/js/scripts/plugins.js in the stats page in the Admin UI in Apache Solr before 5.3.1…

    Affected: fixed in 5.3.1.

    Fixed in 5.3.1 (released Sep 28, 2015, 140 days before disclosure).

    The latest release, 10.1.0, is not affected.

  • Multiple cross-site scripting (XSS) vulnerabilities in the Admin UI in Apache Solr before 5.1 allow remote attackers to inject arbitrary…

    Affected: fixed in 5.1.0.

    Fixed in 5.1.0 (released Apr 13, 2015, 308 days before disclosure).

    The latest release, 10.1.0, is not affected.

  • The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr before 4.1 allows remote attackers to have an unspecified…

    Affected: fixed in 4.1.0.

    Fixed in 4.1.0 (released Jan 21, 2013, 320 days before disclosure).

    The latest release, 10.1.0, is not affected.

  • The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote…

    Affected: fixed in 4.3.1.

    Fixed in 4.3.1 (released Jun 16, 2013, 174 days before disclosure).

    The latest release, 10.1.0, is not affected.

  • The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing…

    Affected: fixed in 4.1.0.

    Fixed in 4.1.0 (released Jan 21, 2013, 320 days before disclosure).

    The latest release, 10.1.0, is not affected.

  • Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a ..

    Affected: fixed in 4.6.0.

    Fixed in 4.6.0 (released Nov 22, 2013, 15 days before disclosure).

    The latest release, 10.1.0, is not affected.