# org.apache.solr:solr-core (Maven) vulnerabilities 31 known vulnerabilities (8 high, 3 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 10.1.0 (Oct 27, 2026): no advisory affects it - Newest unaffected release: 10.1.0 (Oct 27, 2026), the latest release - Dependents: 19 - Releases: 130 since 1.3.0 (Sep 17, 2008) - Registry: https://central.sonatype.com/artifact/org.apache.solr/solr-core - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-44825: 9.4.0 to 9.10.1 (9.11.0 is outside it); 10.0.0 (10.1.0 is outside it) - CVE-2026-22022: 5.3.0 to 9.10.0 (9.10.1 is outside it) - CVE-2026-22444: 8.6.0 to 9.10.0 (9.10.1 is outside it) - CVE-2025-24814: 1.3.0 to 9.7.0 (9.8.0 is outside it) - CVE-2024-52012: 6.6.0 to 9.7.0 (9.8.0 is outside it) - CVE-2023-50291: 6.0.0 to 8.11.2 (8.11.3 is outside it); 9.0.0 to 9.2.1 (9.3.0 is outside it) - CVE-2023-50292: 8.10.0 to 8.11.2 (8.11.3 is outside it); 9.0.0 to 9.2.1 (9.3.0 is outside it) - CVE-2023-50386: 6.0.0 to 8.11.2 (8.11.3 is outside it); 9.0.0 to 9.4.0 (9.4.1 is outside it) - CVE-2023-50290: 9.0.0 to 9.2.1 (9.3.0 is outside it) - CVE-2021-29262: 1.3.0 to 8.8.1 (8.8.2 is outside it) - CVE-2020-13957: 6.6.0 to 8.6.2 (8.6.3 is outside it) - CVE-2018-11802: 1.3.0 to 6.6.5 (6.6.6 is outside it); 7.0.0 to 7.6.0 (7.7.0 is outside it) - CVE-2019-17558: 5.0.0 to 8.3.1 (8.4.0 is outside it) - CVE-2019-12409: 8.1.1 to 8.2.0 (8.3.0 is outside it) - CVE-2019-12401: 1.3.0 to 4.10.4 (5.0.0 is outside it) - CVE-2019-0193: 1.3.0 to 8.1.1 (8.2.0 is outside it) - CVE-2017-3164: 1.3.0 to 7.6.0 (7.7.0 is outside it) - CVE-2019-0192: 5.0.0 to 6.6.6 (7.0.0 is outside it) - CVE-2018-8026: 6.0.0 to 6.6.4 (6.6.5 is outside it); 7.0.0 to 7.3.1 (7.4.0 is outside it) - CVE-2018-8010: 6.6.0 to 6.6.3 (6.6.4 is outside it); 7.0.0 to 7.3.0 (7.3.1 is outside it) - CVE-2018-1308: 1.3.0 to 6.6.2 (6.6.3 is outside it); 7.0.0 to 7.2.1 (7.3.0 is outside it) - CVE-2017-12629: 5.5.0 to 5.5.4 (5.5.5 is outside it); 6.0.0 to 6.6.1 (6.6.2 is outside it); 7.0.0 to 7.0.1 (7.1.0 is outside it) - CVE-2017-9803: 6.2.0 to 6.6.0 (6.6.1 is outside it) - CVE-2017-3163: 1.3.0 to 5.5.3 (5.5.4 is outside it); 6.0.0 to 6.4.0 (6.4.1 is outside it) - CVE-2017-7660: 5.3.0 to 5.5.4 (5.5.5 is outside it); 6.0.0 to 6.5.1 (6.6.0 is outside it) - CVE-2015-8797: 1.3.0 to 5.3.0 (5.3.1 is outside it) - CVE-2015-8795: 1.3.0 to 5.0.0 (5.1.0 is outside it) - CVE-2012-6612: 1.3.0 to 4.0.0 (4.1.0 is outside it) - CVE-2013-6408: 1.3.0 to 4.3.0 (4.3.1 is outside it) - CVE-2013-6407: 1.3.0 to 4.0.0 (4.1.0 is outside it) - CVE-2013-6397: 1.3.0 to 4.5.1 (4.6.0 is outside it) ## Advisories (31) ### [CVE-2026-44825](https://cve.now/CVE-2026-44825): Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users - Severity: High 8.1 - Published: Jun 1, 2026 - Affected: from 9.4.0, through 9.10.1; from 9.4.0, through 9.10.1; versions 10.0.0. - Fixed in 10.1.0 (released Oct 27, 2026, 148 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 10.1.0, is not affected. ### [CVE-2026-22022](https://cve.now/CVE-2026-22022): Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin - Severity: High 8.2 - Published: Jan 21, 2026 - Affected: from 5.3.0, fixed in 9.10.1. - Fixed in 9.10.1 (released Jan 20, 2026, 1 day before disclosure). - The latest release, 10.1.0, is not affected. ### [CVE-2026-22444](https://cve.now/CVE-2026-22444): Apache Solr: Insufficient file-access checking in standalone core-creation requests - Severity: High 7.1 - Published: Jan 21, 2026 - Affected: from 8.6.0, fixed in 9.10.1. - Fixed in 9.10.1 (released Jan 20, 2026, 1 day before disclosure). - The latest release, 10.1.0, is not affected. ### [CVE-2025-24814](https://cve.now/CVE-2025-24814): Apache Solr: Core-creation with "trusted" configset can use arbitrary untrusted files - Severity: Medium 5.4 - Published: Jan 27, 2025 - Affected: fixed in 9.8.0. - Fixed in 9.8.0 (released Jan 21, 2025, 6 days before disclosure). - The latest release, 10.1.0, is not affected. ### [CVE-2024-52012](https://cve.now/CVE-2024-52012): Apache Solr: Configset upload on Windows allows arbitrary path write-access - Severity: Medium 5.4 - Published: Jan 27, 2025 - Affected: from 6.6, fixed in 9.8.0. - Fixed in 9.8.0 (released Jan 21, 2025, 6 days before disclosure). - The latest release, 10.1.0, is not affected. ### [CVE-2023-50291](https://cve.now/CVE-2023-50291): Apache Solr: System Property redaction logic inconsistency can lead to leaked passwords - Severity: High 7.5 - Published: Feb 9, 2024 - Affected: from 6.0.0, fixed in 8.11.3; from 9.0.0, fixed in 9.3.0. - Fixed in 8.11.3 (released Feb 8, 2024, 1 day before disclosure) and 9.3.0 (released Jul 21, 2023, 203 days before disclosure). - The latest release, 10.1.0, is not affected. ### [CVE-2023-50292](https://cve.now/CVE-2023-50292): Apache Solr: Solr Schema Designer blindly "trusts" all configsets, possibly leading to RCE by unauthenticated users - Severity: High 7.5 - Published: Feb 9, 2024 - Affected: from 9.0.0, fixed in 9.3.0; from 8.10.0, fixed in 8.11.3. - Fixed in 8.11.3 (released Feb 8, 2024, 1 day before disclosure) and 9.3.0 (released Jul 21, 2023, 203 days before disclosure). - The latest release, 10.1.0, is not affected. ### [CVE-2023-50386](https://cve.now/CVE-2023-50386): Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets - Severity: High 8.8 - Published: Feb 9, 2024 - Affected: from 6.0.0, fixed in 8.11.3; from 9.0.0, fixed in 9.4.1. - Fixed in 8.11.3 (released Feb 8, 2024, 1 day before disclosure) and 9.4.1 (released Jan 18, 2024, 22 days before disclosure). - The latest release, 10.1.0, is not affected. ### [CVE-2023-50290](https://cve.now/CVE-2023-50290): Apache Solr: Host environment variables are published via the Metrics API - Severity: Medium 6.5 - Published: Jan 15, 2024 - Affected: from 9.0.0, fixed in 9.3.0. - Fixed in 9.3.0 (released Jul 21, 2023, 178 days before disclosure). - The latest release, 10.1.0, is not affected. ### [CVE-2021-29262](https://cve.now/CVE-2021-29262): Misapplied Zookeeper ACLs can result in leakage of configured authentication and authorization settings - Severity: Unrated - Published: Apr 13, 2021 - Affected: fixed in 8.8.2. - Fixed in 8.8.2 (released Apr 12, 2021, 1 day before disclosure). - The latest release, 10.1.0, is not affected. ### [CVE-2020-13957](https://cve.now/CVE-2020-13957): Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used… - Severity: Unrated - Published: Oct 13, 2020 - Affected: from 6.6.0, fixed in 8.6.3. - Fixed in 8.6.3 (released Oct 7, 2020, 6 days before disclosure). - The latest release, 10.1.0, is not affected. ### [CVE-2018-11802](https://cve.now/CVE-2018-11802): In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. - Severity: Unrated - Published: Apr 1, 2020 - Affected: from 7.0.0, fixed in 7.7.0; fixed in 6.6.6. - Fixed in 6.6.6 (released Apr 1, 2019, 366 days before disclosure) and 7.7.0 (released Feb 8, 2019, 418 days before disclosure). - The latest release, 10.1.0, is not affected. ### [CVE-2019-17558](https://cve.now/CVE-2019-17558): Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. - Severity: High 7.5 · KEV - Published: Dec 30, 2019 - Affected: from 5.0.0, fixed in 8.4.0; from 6.0.0, fixed in 8.4.0; from 7.0.0, fixed in 8.4.0; from 8.0.0, fixed in 8.4.0. - Fixed in 8.4.0 (released Dec 28, 2019, 2 days before disclosure). - The latest release, 10.1.0, is not affected. ### [CVE-2019-12409](https://cve.now/CVE-2019-12409): The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE\_REMOTE\_JMX\_OPTS configuration option in the default… - Severity: Unrated - Published: Nov 18, 2019 - Affected: from 8.1.1, fixed in 8.3.0. - Fixed in 8.3.0 (released Oct 31, 2019, 18 days before disclosure). - The latest release, 10.1.0, is not affected. ### [CVE-2019-12401](https://cve.now/CVE-2019-12401): Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack (a.k.a. - Severity: Unrated - Published: Sep 10, 2019 - Affected: fixed in 5.0.0. - Fixed in 5.0.0 (released Feb 19, 2015, 1664 days before disclosure). - The latest release, 10.1.0, is not affected. ### [CVE-2019-0193](https://cve.now/CVE-2019-0193): In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in whi - Severity: High 7.2 · KEV - Published: Aug 1, 2019 - Affected: fixed in 8.2.0. - Fixed in 8.2.0 (released Jul 25, 2019, 7 days before disclosure). - The latest release, 10.1.0, is not affected. ### [CVE-2017-3164](https://cve.now/CVE-2017-3164): Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive). - Severity: Unrated - Published: Mar 8, 2019 - Affected: from 1.3.0, fixed in 7.7.0. - Fixed in 7.7.0 (released Feb 8, 2019, 28 days before disclosure). - The latest release, 10.1.0, is not affected. ### [CVE-2019-0192](https://cve.now/CVE-2019-0192): In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. - Severity: Unrated - Published: Mar 7, 2019 - Affected: from 5.0.0, fixed in 7.0.0; from 6.0.0, fixed in 7.0.0. - Fixed in 7.0.0 (released Sep 19, 2017, 534 days before disclosure). - The latest release, 10.1.0, is not affected. ### [CVE-2018-8026](https://cve.now/CVE-2018-8026): This vulnerability in Apache Solr 6.0.0 to 6.6.4 and 7.0.0 to 7.3.1 relates to an XML external entity expansion (XXE) in Solr config files… - Severity: Unrated - Published: Jul 5, 2018 - Affected: from 7.0.0, fixed in 7.4.0; from 6.0.0, fixed in 6.6.5. - Fixed in 6.6.5 (released Jul 2, 2018, 3 days before disclosure) and 7.4.0 (released Jun 22, 2018, 13 days before disclosure). - The latest release, 10.1.0, is not affected. ### [CVE-2018-8010](https://cve.now/CVE-2018-8010): This vulnerability in Apache Solr 6.0.0 to 6.6.3, 7.0.0 to 7.3.0 relates to an XML external entity expansion (XXE) in Solr config files… - Severity: Unrated - Published: May 21, 2018 - Affected: from 6.6.0, fixed in 6.6.4; from 7.0.0, fixed in 7.3.1. - Fixed in 6.6.4 (released May 17, 2018, 4 days before disclosure) and 7.3.1 (released May 14, 2018, 7 days before disclosure). - The latest release, 10.1.0, is not affected. ### [CVE-2018-1308](https://cve.now/CVE-2018-1308): This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the… - Severity: Unrated - Published: Apr 9, 2018 - Affected: from 1.2, fixed in 6.6.3; from 7.0.0, fixed in 7.3.0. - Fixed in 6.6.3 (released Mar 6, 2018, 34 days before disclosure) and 7.3.0 (released Apr 4, 2018, 5 days before disclosure). - The latest release, 10.1.0, is not affected. ### [CVE-2017-12629](https://cve.now/CVE-2017-12629): Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config… - Severity: Unrated - Published: Oct 14, 2017 - Affected: from 7.0.0, fixed in 7.1.0; from 6.0.0, fixed in 6.6.2; from 5.5.0, fixed in 5.5.5. - Fixed in 5.5.5 (released Oct 23, 2017, 9 days after disclosure), 6.6.2 (released Oct 17, 2017, 3 days after disclosure) and 7.1.0 (released Oct 16, 2017, 2 days after disclosure). - The latest release, 10.1.0, is not affected. ### [CVE-2017-9803](https://cve.now/CVE-2017-9803): Apache Solr's Kerberos plugin can be configured to use delegation tokens, which allows an application to reuse the authentication of an… - Severity: Unrated - Published: Sep 18, 2017 - Affected: from 6.2.0, fixed in 6.6.1. - Fixed in 6.6.1 (released Sep 5, 2017, 13 days before disclosure). - The latest release, 10.1.0, is not affected. ### [CVE-2017-3163](https://cve.now/CVE-2017-3163): When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts… - Severity: Unrated - Published: Aug 30, 2017 - Affected: fixed in 5.5.4; from 6.0.0, fixed in 6.4.1. - Fixed in 5.5.4 (released Feb 14, 2017, 197 days before disclosure) and 6.4.1 (released Feb 4, 2017, 207 days before disclosure). - The latest release, 10.1.0, is not affected. ### [CVE-2017-7660](https://cve.now/CVE-2017-7660): Apache Solr uses a PKI based mechanism to secure inter-node communication when security is enabled. - Severity: Unrated - Published: Jul 7, 2017 - Affected: from 5.3.0, fixed in 5.5.5; from 6.0.0, fixed in 6.6.0. - Fixed in 5.5.5 (released Oct 23, 2017, 108 days after disclosure) and 6.6.0 (released Jun 5, 2017, 32 days before disclosure). - The latest release, 10.1.0, is not affected. ### [CVE-2015-8797](https://cve.now/CVE-2015-8797): Cross-site scripting (XSS) vulnerability in webapp/web/js/scripts/plugins.js in the stats page in the Admin UI in Apache Solr before 5.3.1… - Severity: Unrated - Published: Feb 15, 2016 - Affected: fixed in 5.3.1. - Fixed in 5.3.1 (released Sep 28, 2015, 140 days before disclosure). - The latest release, 10.1.0, is not affected. ### [CVE-2015-8795](https://cve.now/CVE-2015-8795): Multiple cross-site scripting (XSS) vulnerabilities in the Admin UI in Apache Solr before 5.1 allow remote attackers to inject arbitrary… - Severity: Unrated - Published: Feb 15, 2016 - Affected: fixed in 5.1.0. - Fixed in 5.1.0 (released Apr 13, 2015, 308 days before disclosure). - The latest release, 10.1.0, is not affected. ### [CVE-2012-6612](https://cve.now/CVE-2012-6612): The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr before 4.1 allows remote attackers to have an unspecified… - Severity: Unrated - Published: Dec 7, 2013 - Affected: fixed in 4.1.0. - Fixed in 4.1.0 (released Jan 21, 2013, 320 days before disclosure). - The latest release, 10.1.0, is not affected. ### [CVE-2013-6408](https://cve.now/CVE-2013-6408): The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote… - Severity: Unrated - Published: Dec 7, 2013 - Affected: fixed in 4.3.1. - Fixed in 4.3.1 (released Jun 16, 2013, 174 days before disclosure). - The latest release, 10.1.0, is not affected. ### [CVE-2013-6407](https://cve.now/CVE-2013-6407): The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing… - Severity: Unrated - Published: Dec 7, 2013 - Affected: fixed in 4.1.0. - Fixed in 4.1.0 (released Jan 21, 2013, 320 days before disclosure). - The latest release, 10.1.0, is not affected. ### [CVE-2013-6397](https://cve.now/CVE-2013-6397): Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. - Severity: Unrated - Published: Dec 7, 2013 - Affected: fixed in 4.6.0. - Fixed in 4.6.0 (released Nov 22, 2013, 15 days before disclosure). - The latest release, 10.1.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.apache.solr:solr-core Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.