{ "@id": "urn:uuid:5d61631d-cb68-44e9-a109-bf123328e60e", "role": "Document Creator", "author": "https://tuxcare.com", "version": 2, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-11T18:30:26.330698+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1" } } ], "timestamp": "2026-11-11T18:29:22.818209+00:00", "status_notes": "Vulnerability CVE-2015-8795 does not affect version 7.7.2-tuxcare.1 of org.apache.solr:solr-core. not_affected \u2014 Version 7.7.2 is not affected by CVE-2015-8795. The vulnerable files (scripts/analysis.js and scripts/schema-browser.js) do not exist in this version. Version 7.7.2 uses the Angular-based Admin UI which replaced the old jQuery-based UI in upstream Solr before 7.7.2 was released. The Angular UI uses automatic HTML escaping via Angular's data binding (ng-options, {{ }} interpolation), preventing ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-8795" }, "impact_statement": "not_affected \u2014 Version 7.7.2 is not affected by CVE-2015-8795. The vulnerable files (scripts/analysis.js and scripts/schema-browser.js) do not exist in this version. Version 7.7.2 uses the Angular-based Admin UI which replaced the old jQuery-based UI in upstream Solr before 7.7.2 was released. The Angular UI uses automatic HTML escaping via Angular's data binding (ng-options, {{ }} interpolation), preventing ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1" } } ], "timestamp": "2026-11-11T18:29:22.818209+00:00", "status_notes": "Vulnerability CVE-2015-8797 does not affect version 7.7.2-tuxcare.1 of org.apache.solr:solr-core. not_affected \u2014 CVE-2015-8797 (SOLR-7949) XSS vulnerability is NOT present in Solr 7.7.2. The vulnerable jQuery-based Admin UI file (solr/webapp/web/js/scripts/plugins.js) that allowed XSS via unsanitized entry parameter injection into jQuery selectors no longer exists. It was fixed in 2015 (commit fd33cfdc) by adding .esc() escaping, then completely removed in 2017 (commit 21384b5b) when the old UI was deprec...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-8797" }, "impact_statement": "not_affected \u2014 CVE-2015-8797 (SOLR-7949) XSS vulnerability is NOT present in Solr 7.7.2. The vulnerable jQuery-based Admin UI file (solr/webapp/web/js/scripts/plugins.js) that allowed XSS via unsanitized entry parameter injection into jQuery selectors no longer exists. It was fixed in 2015 (commit fd33cfdc) by adding .esc() escaping, then completely removed in 2017 (commit 21384b5b) when the old UI was deprec..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1" } } ], "timestamp": "2026-11-11T18:29:22.818209+00:00", "status_notes": "Vulnerability CVE-2017-3163 does not affect version 7.7.2-tuxcare.1 of org.apache.solr:solr-core. CVE-2017-3163 affects Apache Solr before 5.5.4 and 6.x before 6.4.1. The target version 7.7.2 is not vulnerable because the fix (SOLR-10031) was already present in the upstream Apache Solr 7.7.2 release that TuxCare onboarded. The fix was committed by Apache committer Jan H\u00f8ydahl (janhoy@apache.org) in commit 6f598d2469 and was included in the upstream release before the first TuxCare commit c96d24788c (\"Onboard version 7.7.2\"). The validateFilenameOrError method in ReplicationHandler.java (lines 1501-1514) prevents path traversal by rejecting file names containing \"..\" and absolute paths, protecting all three file parameters (FILE, CONF_FILE_SHORT, TLOG_FILE) through validation applied in the DirectoryFileStream constructor.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.5.4; >= 6.0.0, < 6.4.1), NVD (<= 5.5.3; = 6.0.0; = 6.0.1; = 6.1.0; = 6.2.0; = 6.2.1; = 6.3.0; = 6.4.0), cve.org (>= 1.4.0, <= 5.5.3; >= 6.0.0, <= 6.4.0), Snyk (>= 1.4.0, < 5.5.4; >= 6.0.0, < 6.4.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-3163" }, "impact_statement": "CVE-2017-3163 affects Apache Solr before 5.5.4 and 6.x before 6.4.1. The target version 7.7.2 is not vulnerable because the fix (SOLR-10031) was already present in the upstream Apache Solr 7.7.2 release that TuxCare onboarded. The fix was committed by Apache committer Jan H\u00f8ydahl (janhoy@apache.org) in commit 6f598d2469 and was included in the upstream release before the first TuxCare commit c96d24788c (\"Onboard version 7.7.2\"). The validateFilenameOrError method in ReplicationHandler.java (lines 1501-1514) prevents path traversal by rejecting file names containing \"..\" and absolute paths, protecting all three file parameters (FILE, CONF_FILE_SHORT, TLOG_FILE) through validation applied in the DirectoryFileStream constructor.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.5.4; >= 6.0.0, < 6.4.1), NVD (<= 5.5.3; = 6.0.0; = 6.0.1; = 6.1.0; = 6.2.0; = 6.2.1; = 6.3.0; = 6.4.0), cve.org (>= 1.4.0, <= 5.5.3; >= 6.0.0, <= 6.4.0), Snyk (>= 1.4.0, < 5.5.4; >= 6.0.0, < 6.4.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1" } } ], "timestamp": "2026-11-11T18:29:22.818209+00:00", "status_notes": "Vulnerability CVE-2017-3164 does not affect version 7.7.2-tuxcare.1 of org.apache.solr:solr-core. CVE-2017-3164 (Server-Side Request Forgery via 'shards' parameter) is NOT present in the target. The vulnerability was fixed in upstream Apache Solr via SOLR-12770 commit 6d63958821 by tflobbe@apache.org on 2019-01-15, which introduced WhitelistHostChecker to validate hosts in the 'shards' parameter. This fix was already present in the upstream 7.7.2 release that TuxCare onboarded (commit c96d24788c). The target contains the complete defense: host:port extraction and whitelist validation with FORBIDDEN rejection for non-whitelisted hosts, enabled by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.3.0, < 7.7.0), NVD (>= 1.3.0, <= 7.6.0), cve.org (>= 1.3.0, <= 1.4.1; >= 3.1.0, <= 3.6.2; >= 4.0.0, <= 4.10.4; >= 5.0.0, <= 5.5.5; >= 6.0.0, <= 6.6.5; >= 7.0.0, <= 7.6.0), Snyk (>= 1.3.0, < 7.6.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-3164" }, "impact_statement": "CVE-2017-3164 (Server-Side Request Forgery via 'shards' parameter) is NOT present in the target. The vulnerability was fixed in upstream Apache Solr via SOLR-12770 commit 6d63958821 by tflobbe@apache.org on 2019-01-15, which introduced WhitelistHostChecker to validate hosts in the 'shards' parameter. This fix was already present in the upstream 7.7.2 release that TuxCare onboarded (commit c96d24788c). The target contains the complete defense: host:port extraction and whitelist validation with FORBIDDEN rejection for non-whitelisted hosts, enabled by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.3.0, < 7.7.0), NVD (>= 1.3.0, <= 7.6.0), cve.org (>= 1.3.0, <= 1.4.1; >= 3.1.0, <= 3.6.2; >= 4.0.0, <= 4.10.4; >= 5.0.0, <= 5.5.5; >= 6.0.0, <= 6.6.5; >= 7.0.0, <= 7.6.0), Snyk (>= 1.3.0, < 7.6.0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1" } } ], "timestamp": "2026-11-11T18:29:22.818209+00:00", "status_notes": "Vulnerability CVE-2018-11802 does not affect version 7.7.2-tuxcare.1 of org.apache.solr:solr-core. not_affected \u2014 CVE-2018-11802 (SOLR-12514): The target Apache Solr 7.7.2 is NOT AFFECTED. The vulnerability (authorization bypass during request proxying to nodes without collection replicas) was fixed upstream by Noble Paul in commit e085fcd3f5952018e6bf465e4a6274b560bdee22 (Jan 5, 2019), which was already included in the Apache Solr 7.7.2 release before TuxCare onboarded it. All fix components are present: ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11802" }, "impact_statement": "not_affected \u2014 CVE-2018-11802 (SOLR-12514): The target Apache Solr 7.7.2 is NOT AFFECTED. The vulnerability (authorization bypass during request proxying to nodes without collection replicas) was fixed upstream by Noble Paul in commit e085fcd3f5952018e6bf465e4a6274b560bdee22 (Jan 5, 2019), which was already included in the Apache Solr 7.7.2 release before TuxCare onboarded it. All fix components are present: ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1" } } ], "timestamp": "2026-11-11T18:29:22.818209+00:00", "status_notes": "Vulnerability CVE-2018-1308 does not affect version 7.7.2-tuxcare.1 of org.apache.solr:solr-core. CVE-2018-1308 (XXE in DataImportHandler's dataConfig parameter) is not present in Apache Solr 7.7.2. The vulnerability was fixed by upstream commit 739a793388 (SOLR-11971) authored by Uwe Schindler, which shipped in the upstream 7.7.2 release before TuxCare onboarded it. The fix installs EmptyEntityResolver.SAX_INSTANCE when parsing XML from untrusted sources (request parameters without SystemId), blocking all external entity resolution attempts via file://, ftp://, or http:// protocols.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.2, < 6.6.3; >= 7.0.0, < 7.3.0), NVD (>= 1.2, <= 6.6.2; >= 7.0.0, <= 7.2.1), cve.org (>= 1.2, <= 6.6.2; >= 7.0.0, <= 7.2.1), Snyk (< 6.6.3; >= 7.0.0, < 7.3.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1308" }, "impact_statement": "CVE-2018-1308 (XXE in DataImportHandler's dataConfig parameter) is not present in Apache Solr 7.7.2. The vulnerability was fixed by upstream commit 739a793388 (SOLR-11971) authored by Uwe Schindler, which shipped in the upstream 7.7.2 release before TuxCare onboarded it. The fix installs EmptyEntityResolver.SAX_INSTANCE when parsing XML from untrusted sources (request parameters without SystemId), blocking all external entity resolution attempts via file://, ftp://, or http:// protocols.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.2, < 6.6.3; >= 7.0.0, < 7.3.0), NVD (>= 1.2, <= 6.6.2; >= 7.0.0, <= 7.2.1), cve.org (>= 1.2, <= 6.6.2; >= 7.0.0, <= 7.2.1), Snyk (< 6.6.3; >= 7.0.0, < 7.3.0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1" } } ], "timestamp": "2026-11-11T18:29:22.818209+00:00", "status_notes": "Vulnerability CVE-2019-0192 does not affect version 7.7.2-tuxcare.1 of org.apache.solr:solr-core. Version 7.7.2 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-xhcq-fv7x-grr2 (affected below 7.0.0), NVD (affected up to 6.6.5), CVE record (affected up to 6.6.5), Snyk (affected below 7.0.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-0192" }, "impact_statement": "Version 7.7.2 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-xhcq-fv7x-grr2 (affected below 7.0.0), NVD (affected up to 6.6.5), CVE record (affected up to 6.6.5), Snyk (affected below 7.0.0)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1" } } ], "timestamp": "2026-11-11T18:30:26.330698+00:00", "status_notes": "Vulnerability CVE-2019-0193 is fixed in version 7.7.2-tuxcare.1 of org.apache.solr:solr-core.", "vulnerability": { "name": "CVE-2019-0193" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1" } } ], "timestamp": "2026-11-11T18:29:22.818209+00:00", "status_notes": "Vulnerability CVE-2019-12401 does not affect version 7.7.2-tuxcare.1 of org.apache.solr:solr-core. CVE-2019-12401 (XML entity expansion / Lol Bomb attack) is NOT present in Solr 7.7.2. The target contains TWO upstream Apache fixes that were shipped in the 7.7.2 release: (1) EmptyEntityResolver (2012) blocks all external entity resolution by returning empty streams, and (2) Woodstox upgrade to 4.4.1 (2015) provides additional entity expansion protections. All production XML parsers (XMLLoader, DocumentAnalysisRequestHandler, XPathRecordReader) are configured with EmptyEntityResolver. Both fixes were authored by Apache developers and were present in the upstream 7.7.2 release when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.0.0), NVD (>= 1.3.0, <= 1.4.1; >= 3.1, <= 3.6.2; >= 4.0.0, <= 4.10.4), cve.org (>= 1.3.0, <= 1.4.1; >= 3.1.0, <= 3.6.2; >= 4.0.0, <= 4.10.4), Snyk (< 5.0.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12401" }, "impact_statement": "CVE-2019-12401 (XML entity expansion / Lol Bomb attack) is NOT present in Solr 7.7.2. The target contains TWO upstream Apache fixes that were shipped in the 7.7.2 release: (1) EmptyEntityResolver (2012) blocks all external entity resolution by returning empty streams, and (2) Woodstox upgrade to 4.4.1 (2015) provides additional entity expansion protections. All production XML parsers (XMLLoader, DocumentAnalysisRequestHandler, XPathRecordReader) are configured with EmptyEntityResolver. Both fixes were authored by Apache developers and were present in the upstream 7.7.2 release when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.0.0), NVD (>= 1.3.0, <= 1.4.1; >= 3.1, <= 3.6.2; >= 4.0.0, <= 4.10.4), cve.org (>= 1.3.0, <= 1.4.1; >= 3.1.0, <= 3.6.2; >= 4.0.0, <= 4.10.4), Snyk (< 5.0.0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1" } } ], "timestamp": "2026-11-11T18:29:22.818209+00:00", "status_notes": "Vulnerability CVE-2019-12409 does not affect version 7.7.2-tuxcare.1 of org.apache.solr:solr-core. Apache Solr 7.7.2 is NOT affected by CVE-2019-12409. The vulnerability was a regression in versions 8.1.1 and 8.2.0 where the default solr.in.sh configuration had ENABLE_REMOTE_JMX_OPTS=\"true\" (uncommented), which enabled unauthenticated remote JMX access. Version 7.7.2 has the safe configuration: #ENABLE_REMOTE_JMX_OPTS=\"false\" (commented out, disabled by default). The vulnerable pattern never existed in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12409" }, "impact_statement": "Apache Solr 7.7.2 is NOT affected by CVE-2019-12409. The vulnerability was a regression in versions 8.1.1 and 8.2.0 where the default solr.in.sh configuration had ENABLE_REMOTE_JMX_OPTS=\"true\" (uncommented), which enabled unauthenticated remote JMX access. Version 7.7.2 has the safe configuration: #ENABLE_REMOTE_JMX_OPTS=\"false\" (commented out, disabled by default). The vulnerable pattern never existed in this version." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1" } } ], "timestamp": "2026-11-11T18:30:26.330698+00:00", "status_notes": "Vulnerability CVE-2019-17558 is fixed in version 7.7.2-tuxcare.1 of org.apache.solr:solr-core.", "vulnerability": { "name": "CVE-2019-17558" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1" } } ], "timestamp": "2026-11-11T18:30:26.330698+00:00", "status_notes": "Vulnerability CVE-2020-13957 is fixed in version 7.7.2-tuxcare.1 of org.apache.solr:solr-core.", "vulnerability": { "name": "CVE-2020-13957" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1" } } ], "timestamp": "2026-11-11T18:29:22.818209+00:00", "status_notes": "Vulnerability CVE-2021-29262 affects version 7.7.2-tuxcare.1 of org.apache.solr:solr-core.", "vulnerability": { "name": "CVE-2021-29262" }, "action_statement": "Vulnerability CVE-2021-29262 affects version 7.7.2-tuxcare.1 of org.apache.solr:solr-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1" } } ], "timestamp": "2026-11-11T18:29:22.818209+00:00", "status_notes": "Vulnerability CVE-2023-50291 affects version 7.7.2-tuxcare.1 of org.apache.solr:solr-core.", "vulnerability": { "name": "CVE-2023-50291" }, "action_statement": "Vulnerability CVE-2023-50291 affects version 7.7.2-tuxcare.1 of org.apache.solr:solr-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1" } } ], "timestamp": "2026-11-11T18:29:22.818209+00:00", "status_notes": "Vulnerability CVE-2023-50292 affects version 7.7.2-tuxcare.1 of org.apache.solr:solr-core.", "vulnerability": { "name": "CVE-2023-50292" }, "action_statement": "Vulnerability CVE-2023-50292 affects version 7.7.2-tuxcare.1 of org.apache.solr:solr-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1" } } ], "timestamp": "2026-11-11T18:29:22.818209+00:00", "status_notes": "Vulnerability CVE-2023-50386 affects version 7.7.2-tuxcare.1 of org.apache.solr:solr-core.", "vulnerability": { "name": "CVE-2023-50386" }, "action_statement": "Vulnerability CVE-2023-50386 affects version 7.7.2-tuxcare.1 of org.apache.solr:solr-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1" } } ], "timestamp": "2026-11-11T18:29:22.818209+00:00", "status_notes": "Vulnerability CVE-2024-52012 affects version 7.7.2-tuxcare.1 of org.apache.solr:solr-core.", "vulnerability": { "name": "CVE-2024-52012" }, "action_statement": "Vulnerability CVE-2024-52012 affects version 7.7.2-tuxcare.1 of org.apache.solr:solr-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1" } } ], "timestamp": "2026-11-11T18:29:22.818209+00:00", "status_notes": "Vulnerability CVE-2025-24814 affects version 7.7.2-tuxcare.1 of org.apache.solr:solr-core.", "vulnerability": { "name": "CVE-2025-24814" }, "action_statement": "Vulnerability CVE-2025-24814 affects version 7.7.2-tuxcare.1 of org.apache.solr:solr-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1" } } ], "timestamp": "2026-11-11T18:30:26.330698+00:00", "status_notes": "Vulnerability CVE-2026-22022 is fixed in version 7.7.2-tuxcare.1 of org.apache.solr:solr-core.", "vulnerability": { "name": "CVE-2026-22022" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.solr/solr-core@7.7.2-tuxcare.1" } } ], "timestamp": "2026-11-11T18:29:22.818209+00:00", "status_notes": "Vulnerability CVE-2026-22444 does not affect version 7.7.2-tuxcare.1 of org.apache.solr:solr-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. Solr 7.7.2 is not affected because it lacks the configurable allowPaths restriction that this vulnerability bypasses. The XML parser has no allowPaths setting at solr/core/src/java/org/apache/solr/core/SolrXmlConfig.java:231 and rejects unknown settings at solr/core/src/java/org/apache/solr/core/SolrXmlConfig.java:278.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-22444" }, "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. Solr 7.7.2 is not affected because it lacks the configurable allowPaths restriction that this vulnerability bypasses. The XML parser has no allowPaths setting at solr/core/src/java/org/apache/solr/core/SolrXmlConfig.java:231 and rejects unknown settings at solr/core/src/java/org/apache/solr/core/SolrXmlConfig.java:278." } ] }