Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Apache Lucene: Unauthorized Access to System Resources
published 1 year ago
Summary
Apache Lucene is a library used for search functionality in some applications. A security exception in Lucene can allow an attacker to access system resources in unauthorized ways. This issue is a result of a bug in the SoraniNormalizer component, which is used in certain language analysis and filtering processes. To protect your application, update to the latest version of Apache Lucene if you use it for search functionality.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| OSS-Fuzz | – | lucene | All versions |
Original advisory text
Security exception in org.apache.lucene.analysis.ckb.SoraniNormalizer.normalize
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=407477665
```
Crash type: Security exception
Crash state:
org.apache.lucene.analysis.ckb.SoraniNormalizer.normalize
org.apache.lucene.analysis.ckb.SoraniNormalizationFilter.incrementToken
org.apache.lucene.analysis.miscellaneous.WordDelimiterGraphFilter.incrementToken
```
```
Crash type: Security exception
Crash state:
org.apache.lucene.analysis.ckb.SoraniNormalizer.normalize
org.apache.lucene.analysis.ckb.SoraniNormalizationFilter.incrementToken
org.apache.lucene.analysis.miscellaneous.WordDelimiterGraphFilter.incrementToken
```
References
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=407477665 Third Party Advisory
Timeline
Published3 Apr 2025
Updated6 Mar 2026
First seen6 Mar 2026
Track software like this
Free during beta