CVE-2026-47898CWE-611

Apache Lucene.Net: XXE vulnerability in Lucene.Net.Analysis.Common PatternParser

Medium · published July 3, 2026

CVSS v4.0
4.0
EPSS
0%
Percentile
39.6
In the wild
Unconfirmed
What it is

Improper Restriction of XML External Entity Reference vulnerability in Apache Lucene.Net (Lucene.Net.Analysis.Common library).

This issue affects Apache Lucene.Net.Analysis.Common: from 4.8.0-beta00005 before 4.8.0-beta00018.

Users are recommended to upgrade to version 4.8.0-beta00018, which fixes the issue.

The record
Technical detail
CVSS v4.0
4.0 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00468 · 39.6th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2026-07-03T07:47Z
EPSS history
Timeline
  • 03 JUL 07:47Z
    Apache Lucene.Net: XXE vulnerability in Lucene.Net.Analysis.Common PatternParser
    cvelistv5