[
https://issues.apache.org/jira/browse/SOLR-18392?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Eric Pugh resolved SOLR-18392.
------------------------------
Fix Version/s: 10.1
Resolution: Fixed
This is already fixed, but yeah, we need to get a 10.1 out.
> Upgrade org.apache.opennlp:opennlp-tools to 2.5.9 or later to remediate
> CVE-2026-42440
> --------------------------------------------------------------------------------------
>
> Key: SOLR-18392
> URL: https://issues.apache.org/jira/browse/SOLR-18392
> Project: Solr
> Issue Type: Bug
> Security Level: Public(Default Security Level. Issues are Public)
> Components: Server
> Affects Versions: 10.0
> Environment: OS: Linux, Windows, macOS
> Solr Version: 10.0.0
> Java: 11+
> Maven: 3.6+
> Reporter: Leszek
> Priority: Major
> Labels: cve, dependency-upgrade, opennlp, security
> Fix For: 10.1
>
>
> h3. Summary
> Solr 10.0.0 currently includes {{opennlp-tools}} version 2.5.6, which is
> vulnerable to CVE-2026-42440. This vulnerability is remediated in versions >=
> 2.5.9. This ticket tracks the upgrade of the OpenNLP libraries to patch the
> vulnerability.
> h3. Current State
> * Solr 10.0.0 includes {{opennlp-tools}} version 2.5.6
> * This version is vulnerable to CVE-2026-42440
> * The vulnerability is fixed in versions >= 2.5.9
> * OpenNLP is used across multiple Solr modules:
> ** {{modules/analysis-extras/lib/}} — NLP-based text analysis and
> tokenization
> ** {{modules/langid/lib/}} — Language identification
> ** {{modules/extraction/lib/}} — Document content extraction
> h3. Required Changes
> # Update {{opennlp-tools}} dependency from 2.5.6 to 2.5.9 or later
> # Update {{opennlp-dl}} dependency to the corresponding version (currently
> 2.5.6)
> Note: {{opennlp-dl}} is the companion library providing pre-trained NLP
> models. Version mismatch between tools and models can cause runtime failures
> due to API incompatibilities or format changes.
> h3. Verification Requirements
> Before merging the upgrade, verify compatibility across all affected modules:
> h4. API Compatibility
> * Confirm that {{{}analysis-extras{}}}, {{{}langid{}}}, and {{extraction}}
> modules work with the new OpenNLP APIs
> * Test any NLP processing behavioral changes between 2.5.6 and 2.5.9
> * Verify that existing Solr configurations continue to function correctly
> h4. Testing Scope
> * Unit tests for modules using OpenNLP
> * Integration tests with sample NLP-intensive workloads
> * Compatibility validation across all affected modules
> h3. Related Issues
> * CVE-2026-42440: Vulnerability in org.apache.opennlp:opennlp-tools < 2.5.9
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
