CVE-2020-27223

CVE-2020-27223 affects Eclipse Jetty 9.4.6.v20170531–9.4.36.v20210114, 10.0.0, and 11.0.0, where handling requests with multiple Accept headers and many quality (q) values can cause high CPU usage and a DoS. Public sources consistently describe CPU exhaustion as the impact. Remediation is to upgr...

CVE-2024-52012

Apache Solr (Windows) is affected by CVE-2024-52012: a relative path traversal (zip slip) via the configset upload API that can allow arbitrary file writes to the filesystem. Affected versions are Solr 6.6 through 9.7.0. The root cause is insufficient input sanitation in the configset upload path...

CVE-2025-24814

Summary of CVE-2025-24814 (Apache Solr): Solr instances using FileSystemConfigSetService (default in standalone or user-managed mode) and lacking authentication/authorization are vulnerable to privilege escalation where replacement of trusted configset files can be treated as trusted. This can al...

CVE-2018-8026

CVE-2018-8026 affects Apache Solr releases 6.0.0–6.6.4 and 7.0.0–7.3.1, due to an XML External Entity (XXE) flaw in Solr config files (currency.xml, enumsConfig.xml referenced from schema.xml, and TIKA parsecontext) and related XInclude handling. An attacker could craft XML and upload manipulated...

CVE-2018-8010

The CVE-2018-8010 issue affects Apache Solr 6.0.0–6.6.3 and 7.0.0–7.3.0, arising from an XML External Entity (XXE) expansion in Solr’s config files (solrconfig.xml, schema.xml, managed-schema) and related XInclude handling. An attacker could use XXE via file/ftp/http references to read arbitrary ...