What’s Vulnerable › Products
Apache Software Foundation Apache Solr vulnerabilities
47 known vulnerabilities, 3 confirmed exploited in the wild (CISA KEV), 5 published in the last 12 months.
Check whether your Apache Software Foundation Apache Solr version is affected
Exploited Apache Software Foundation Apache Solr vulnerabilities
- CVE-2023-44487 — HTTP/2 Rapid Reset Attack Vulnerability
- CVE-2019-0193 — Apache Solr DataImportHandler Code Injection Vulnerability
- CVE-2019-17558 — Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability
Latest Apache Software Foundation Apache Solr vulnerabilities
- CVE-2026-44825 — Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users (CVSS 9.8)
- CVE-2026-22444 — Apache Solr: Insufficient file-access checking in standalone core-creation requests (CVSS 7.1)
- CVE-2026-22022 — Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin (CVSS 8.2)
- CVE-2025-24814 — Apache Solr: Core-creation with "trusted" configset can use arbitrary untrusted files (CVSS 5.5)
- CVE-2024-52012 — Apache Solr: Configset upload on Windows allows arbitrary path write-access (CVSS 5.4)
- CVE-2024-45217 — Apache Solr: ConfigSets created during a backup restore command are trusted implicitly (CVSS 8.1)
- CVE-2024-45216 — Apache Solr: Authentication bypass possible using a fake URL Path ending (CVSS 9.8)
- CVE-2023-50386 — Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets (CVSS 8.8)
- CVE-2023-50298 — Apache Solr: Solr can expose ZooKeeper credentials via Streaming Expressions (CVSS 7.5)
- CVE-2023-50292 — Apache Solr: Solr Schema Designer blindly "trusts" all configsets, possibly leading to RCE by unauthenticated users (CVSS 7.5)
- CVE-2023-50291 — Apache Solr: System Property redaction logic inconsistency can lead to leaked passwords (CVSS 7.5)
- CVE-2023-50290 — Apache Solr: Host environment variables are published via the Metrics API (CVSS 6.5)
- CVE-2023-44487 — HTTP/2 Rapid Reset Attack Vulnerability (CVSS 7.5) — exploited
- CVE-2021-44548 — Apache Solr information disclosure vulnerability through DataImportHandler (CVSS 9.8)
- CVE-2021-33813 — (CVSS 7.5)
- CVE-2021-29943 — Apache Solr Unprivileged users may be able to perform unauthorized read/write to collections (CVSS 9.1)
- CVE-2021-29262 — Misapplied Zookeeper ACLs can result in leakage of configured authentication and authorization settings (CVSS 7.5)
- CVE-2021-27905 — SSRF vulnerability with the Replication handler (CVSS 9.8)
- CVE-2021-28163 — (CVSS 2.7)
- CVE-2020-27223 — (CVSS 5.3)
- CVE-2020-9492 — (CVSS 8.8)
- CVE-2020-13957 — (CVSS 9.8)
- CVE-2020-13941 — (CVSS 8.8)
- CVE-2018-11802 — (CVSS 4.3)
- CVE-2019-17558 — Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability (CVSS 7.5) — exploited