CVE-2026-47898

EPSS 0.35%
Veröffentlicht 03.07.2026 07:47:38
Zuletzt bearbeitet 08.07.2026 18:25:07
Erkennungen
Login

Apache Lucene.Net: XXE vulnerability in Lucene.Net.Analysis.Common PatternParser

Improper Restriction of XML External Entity Reference vulnerability in Apache Lucene.Net (Lucene.Net.Analysis.Common library).

This issue affects Apache Lucene.Net.Analysis.Common: from 4.8.0-beta00005 before 4.8.0-beta00018.

Users are recommended to upgrade to version 4.8.0-beta00018, which fixes the issue.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 5

NVD 13 VulnDex Vulnerability Enrichment 1

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Apache ≫ Lucene.Net Version 4.8.0 Update beta00005

Apache ≫ Lucene.Net Version 4.8.0 Update beta00006

Apache ≫ Lucene.Net Version 4.8.0 Update beta00007

Apache ≫ Lucene.Net Version 4.8.0 Update beta00008

Apache ≫ Lucene.Net Version 4.8.0 Update beta00009

Apache ≫ Lucene.Net Version 4.8.0 Update beta00010

Apache ≫ Lucene.Net Version 4.8.0 Update beta00011

Apache ≫ Lucene.Net Version 4.8.0 Update beta00012

Apache ≫ Lucene.Net Version 4.8.0 Update beta00013

Apache ≫ Lucene.Net Version 4.8.0 Update beta00014

Apache ≫ Lucene.Net Version 4.8.0 Update beta00015

Apache ≫ Lucene.Net Version 4.8.0 Update beta00016

Apache ≫ Lucene.Net Version 4.8.0 Update beta00017

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.35%	0.273

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Apache	4	0	0	CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CWE-611 Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

https://lists.apache.org/thread/7yn9k6sbbsk18yco5y2hszpcf8dst489

Vendor Advisory

Mailing List

http://www.openwall.com/lists/oss-security/2026/07/03/3

Third Party Advisory

Mailing List

https://nvd.nist.gov/vuln/detail/CVE-2026-47898

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2026-47898

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2026-47898

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2026-47898