You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@solr.apache.org by "ppkarwasz (via GitHub)" <gi...@apache.org> on 2026/06/17 19:48:31 UTC
[PR] SOLR-18288: VEX statements for the April 2026 Apache Log4j CVEs [solr-site]
ppkarwasz opened a new pull request, #195:
URL: https://github.com/apache/solr-site/pull/195
You broke it, you fix it. Since we (the Log4j team) decided to pollute the world with these CVEs, the least we can do is help evaluate their (negligible) impact on Apache Solr.
This adds VEX statements for the five April 2026 Apache Log4j CVEs, assessed against the **Solr 9.10.1** binary distribution:
| CVE | Component | Verdict |
| --- | --- | --- |
| CVE-2026-34477 | log4j-core | not_affected / requires_configuration |
| CVE-2026-34478 | log4j-core | not_affected / requires_configuration |
| CVE-2026-34479 | log4j-1.2-api | not_affected / requires_configuration |
| CVE-2026-34480 | log4j-core | not_affected / requires_configuration |
| CVE-2026-34481 | log4j-layout-template-json | not_affected / code_not_reachable |
**TL;DR: none of these are reachable in a stock Solr install.**
* 34477-34480 all require swapping Solr's default `PatternLayout` for some exotic layout or appender (`XmlLayout`, `Rfc5424Layout`, the Log4j 1 bridge, or a TLS network appender). If you didn't go out of your way to do that, you are fine.
* 34481 needs someone to log a `MapMessage` with a `NaN`/`Infinity` float through `JsonTemplateLayout`. A scan of all 486 jars in the distribution shows nothing ever produces a `MapMessage`, so it is simply unreachable.
Each statement spells out the exact configuration that would make you vulnerable, and which jar in `server/lib/ext/` to swap if you really did go off-piste.
Solves SOLR-18288.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
Re: [PR] SOLR-18288: VEX statements for the April 2026 Apache Log4j CVEs [solr-site]
Posted by "epugh (via GitHub)" <gi...@apache.org>.
epugh commented on code in PR #195:
URL: https://github.com/apache/solr-site/pull/195#discussion_r3448887042
##########
content/solr/vex/2026-04-10-cve-2026-34477.md:
##########
@@ -0,0 +1,44 @@
+---
+cve: CVE-2026-34477
+jira: SOLR-18288
+category:
+ - solr/vex
+versions: "9.10.1, 10.0.0"
Review Comment:
Right... okay, well, I'm going to merge this for now.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
Re: [PR] SOLR-18288: VEX statements for the April 2026 Apache Log4j CVEs [solr-site]
Posted by "epugh (via GitHub)" <gi...@apache.org>.
epugh commented on code in PR #195:
URL: https://github.com/apache/solr-site/pull/195#discussion_r3435767083
##########
content/solr/vex/2026-04-10-cve-2026-34477.md:
##########
@@ -0,0 +1,44 @@
+---
+cve: CVE-2026-34477
+jira: SOLR-18288
+category:
+ - solr/vex
+versions: "9.10.1, 10.0.0"
Review Comment:
so... can you maybe help me understand this a bit better. Can I take the data in the `versions` tag, the 'jars' tag, the `analysis` tag and rephrase it as "For Solr 9.10.1 and 10.0.0 that use logj4j-core-2.25.3 that we are not affected unless you use exotic configuraiton"?
Now, when 9.11 comes out, are we implicitly saying that this issue no longer applies because 9.11 will use log4j-core-2.25.4.jar ? Likewise, if I go look at `main` and `branch_10x` I will see the fixed jar files there.
I want to make sure I am understanding this VEX file properly!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
Re: [PR] SOLR-18288: VEX statements for the April 2026 Apache Log4j CVEs [solr-site]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on PR #195:
URL: https://github.com/apache/solr-site/pull/195#issuecomment-4738494512
My overall assessment is that the streak of CVEs we released in April has marginal impact on Solr 9.10.1 (or Solr 10.0.0) and does not, by itself, warrant a new release.
The users who could be impacted fall into two groups:
- the rare category that reconfigures Solr to log to a syslog server, and
- the non-existent category that uses XML as its logging format.
All of these CVEs concern the resilience of the logging pipeline, with a worst case of a SIEM crashing on invalid input, logs being mangled, or logs being intercepted by an adversary with MitM capability. They matter to users who have very high requirements for log integrity, whereas most users are content to parse the non-machine-readable output of `PatternLayout` and are unbothered when the occasional line fails to parse.
We had to publish these CVEs because suitability for audit logging is one of the features that sets Log4j Core apart from the much simpler Logback. But the message for most users is the same: you would have to tighten your logging hygiene and customize Solr quite heavily before any of these CVEs has a visible impact.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
Re: [PR] SOLR-18288: VEX statements for the April 2026 Apache Log4j CVEs [solr-site]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on PR #195:
URL: https://github.com/apache/solr-site/pull/195#issuecomment-4738260950
I'll ask @vy to double-check my descriptions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
Re: [PR] SOLR-18288: VEX statements for the April 2026 Apache Log4j CVEs [solr-site]
Posted by "epugh (via GitHub)" <gi...@apache.org>.
epugh merged PR #195:
URL: https://github.com/apache/solr-site/pull/195
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
Re: [PR] SOLR-18288: VEX statements for the April 2026 Apache Log4j CVEs [solr-site]
Posted by "epugh (via GitHub)" <gi...@apache.org>.
epugh commented on code in PR #195:
URL: https://github.com/apache/solr-site/pull/195#discussion_r3435798376
##########
content/solr/vex/2026-04-10-cve-2026-34477.md:
##########
@@ -0,0 +1,44 @@
+---
+cve: CVE-2026-34477
+jira: SOLR-18288
+category:
+ - solr/vex
+versions: "9.10.1, 10.0.0"
Review Comment:
Just want to confirm this and then I'll merge!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
Re: [PR] SOLR-18288: VEX statements for the April 2026 Apache Log4j CVEs [solr-site]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on code in PR #195:
URL: https://github.com/apache/solr-site/pull/195#discussion_r3436546310
##########
content/solr/vex/2026-04-10-cve-2026-34477.md:
##########
@@ -0,0 +1,44 @@
+---
+cve: CVE-2026-34477
+jira: SOLR-18288
+category:
+ - solr/vex
+versions: "9.10.1, 10.0.0"
Review Comment:
The `versions` field is only displayed in the HTML version.
We have still to figure out how to properly encode it in a VEX file. For example the [OpenVEX specification](https://github.com/openvex/spec/blob/main/OPENVEX-SPEC.md) would require us to give the precise version of the product in each statement.
I don't think we need to mention explicitly which version of Log4j is included in Apache Solr 9.10.1 and 10.0.0, that field is also for the HTML version, so users can find the vulnerable JAR.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org