Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN717
_____________________________________________________________________


DATE                : 03/07/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache Lucene.Net 
                              (Lucene.Net.Analysis.Common),
                    Apache Lucene.Net (Lucene.Net.Replicator)
                           versions prior to 4.8.0-beta00018.
 
=====================================================================

https://lists.apache.org/thread/1xzn6qklrqzhlk8whctonsd8msk30drj
https://lists.apache.org/thread/yhbsqskbbs06jjmpyozjh89fbkw0gd2l
_____________________________________________________________________


CVE-2026-47898: Apache Lucene.Net: XXE vulnerability in
Lucene.Net.Analysis.Common PatternParser

Severity: 

Affected versions:

- Apache Lucene.Net (Lucene.Net.Analysis.Common) 4.8.0-beta00005
before 4.8.0-beta00018

Description:

Improper Restriction of XML External Entity Reference vulnerability in
Apache Lucene.Net (Lucene.Net.Analysis.Common library).

This issue affects Apache Lucene.Net.Analysis.Common: from
4.8.0-beta00005 before 4.8.0-beta00018.

Users are recommended to upgrade to version 4.8.0-beta00018, which fixes
the issue.

Credit:

Daniel Cervera (reporter)
Paul Irwin (coordinator)
Shad Storhaug (remediation reviewer)

References:

https://lucenenet.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-47898


_____________________________________________________________________


CVE-2026-47897: Apache Lucene.Net: Arbitrary file write from
malicious server to Lucene.Net.Replicator client

Severity: 

Affected versions:

- Apache Lucene.Net (Lucene.Net.Replicator) 4.8.0-beta00005 before
4.8.0-beta00018

Description:

Improper Limitation of a Pathname to a Restricted Directory
('Path Traversal') vulnerability in Apache Lucene.Net
(Lucene.Net.Replicator library).

This issue affects Apache Lucene.Net.Replicator: from 4.8.0-beta00005
before 4.8.0-beta00018.

Users are recommended to upgrade to version 4.8.0-beta00018, which
fixes the issue.

Credit:

Daniel Cervera (reporter)
Paul Irwin (coordinator)
Shad Storhaug (remediation reviewer)

References:

https://lucenenet.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-47897

_____________________________________________________________________

CVE-2026-47896: Apache Lucene.Net: Unauthenticated arbitrary file
read on the Lucene.Net.Replicator replication server

Severity: 

Affected versions:

- Apache Lucene.Net (Lucene.Net.Replicator) 4.8.0-beta00005 before
4.8.0-beta00018

Description:

Improper Limitation of a Pathname to a Restricted Directory ('Path
Traversal') vulnerability in Apache Lucene.Net
(Lucene.Net.Replicator library).

This issue affects Apache Lucene.Net.Replicator: from 4.8.0-beta00005
through 4.8.0-beta00017.

Users are recommended to upgrade to version 4.8.0-beta00018, which
fixes the issue.

Credit:

Daniel Cervera (reporter)
Paul Irwin (coordinator)
Shad Storhaug (remediation reviewer)

References:

https://lucenenet.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-47896


=========================================================

+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================