You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@solr.apache.org by Michael Schulpen <ms...@mspsgroep.nl> on 2026/09/21 12:44:45 UTC
upgrade log4j to version 2.26.4
Could you please do an upgrade to log4j version 2.26.4
Because al other version has vulnerabilities registered.
Michael Schulpen
Systeembeheer
[Infomedics]
www.infomedics.nl<https://www.infomedics.nl/>
Dit bericht is uitsluitend bestemd voor de geadresseerde[n]. Het bericht kan persoonlijke of vertrouwelijke informatie bevatten. Indien u niet de beoogde geadresseerde bent, is gebruik, openbaarmaking, vermenigvuldiging, verspreiding en/of verstrekking van deze informatie aan derden niet toegestaan. In dat geval verzoeken wij u vriendelijk om het origineel te vernietigen en de afzender hierover te informeren
Re: upgrade log4j to version 2.26.4
Posted by "Piotr P. Karwasz" <pk...@apache.org>.
Hi Michael,
There is no Log4j 2.26.4: you probably meant 2.25.4.
The latest Log4j 2 release is 2.26.1 (June 2026), and recent Solr
versions already ship it:
* Solr 9.11.0: Log4j 2.26.1
* Solr 10.1.0 (release vote in progress): Log4j 2.26.1
* Solr 9.10.1 and 10.0.0: Log4j 2.25.3
If your scanner flags Log4j in Solr 9.10.1 or 10.0.0, it is most likely
reporting CVE-2026-34477, CVE-2026-34478, CVE-2026-34479, CVE-2026-34480
or CVE-2026-34481. The Solr project has analysed all of them in its VEX
statements [1]: none of them is exploitable with the logging
configuration shipped with Solr. They all require either a non-default
appender or layout (TLS Socket/SMTP/Syslog appenders, Rfc5424Layout,
XmlLayout, Log4j1XmlLayout) or application code that Solr doesn't have.
Your scanner may also report CVE-2026-49844 (log4j-api, fixed in 2.25.5
and 2.26.1) against 2.25.3. Speaking as a member of the Logging PMC, it
requires logging a MapMessage with an attacker-controlled floating-point
value, and, as explained in the VEX entry for CVE-2026-34481, nothing in
the Solr distribution logs MapMessages. I can add a VEX entry for it.
The simplest way to make the warnings go away is to upgrade to Solr
9.11.0. If your scanner reports a different CVE, please let us know the
identifier and the Solr version you are running.
[1] https://solr.apache.org/vex.html
Piotr
On 2026-09-21T12:44:45Z, Michael Schulpen wrote:
> Could you please do an upgrade to log4j version 2.26.4
>
> Because al other version has vulnerabilities registered.
>
> Michael Schulpen
> Systeembeheer
>
> [Infomedics]
>
> www.infomedics.nl<https://www.infomedics.nl/>
>
> Dit bericht is uitsluitend bestemd voor de geadresseerde[n]. Het
> bericht kan persoonlijke of vertrouwelijke informatie bevatten. Indien
> u niet de beoogde geadresseerde bent, is gebruik, openbaarmaking,
> vermenigvuldiging, verspreiding en/of verstrekking van deze informatie
> aan derden niet toegestaan. In dat geval verzoeken wij u vriendelijk om
> het origineel te vernietigen en de afzender hierover te informeren
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@solr.apache.org
For additional commands, e-mail: dev-help@solr.apache.org