Known vulnerabilities in the recommended Solr version

Data Services
, ,
1

Hello everyone!

Our application is currently running on A12 2023.06ext11. We are operating it as recommended with a standalone Solr instance, version 9.8.1.

See GetA12

However, several critical CVEs are known for this version. More specifically:

  • CVE-2025-66516 (org.apache.tika:tika-core)
  • CVE-2025-54988 (org.apache.tika:tika-parsers)
  • CVE-2025-12383 (org.glassfish.jersey.core:jersey-client)
  • CVE-2024-4756 (org.apache.avro:avro)

The application migration to 2024.06ext10 is nearly complete. The switch to A12 2025.06, which will eliminate Solr in our infrastructure, is planned but will take some time.

Therefore, my question is:

  1. Is this issue with the CVEs known, and are there any recommendations for dealing with them? An investigation revealed that even switching to Solr 9.10 does not resolve the problems. The CVEs are only removed from Solr 10. But we reject a major update of a component, that will become obsolete in the near future.
  2. Is it possible to say whether the CVEs actually create vulnerabilities that make our A12 application susceptible to attack?
2

Hi @mathias-early-ravine ,

The migration to Solr 10 would be normally done in 2025.06 where these violations would be fixed, but in 2025.06 we migrated away from Solr. In 2024.06 it is not possible to migrate to 2024.06 without significant effort and the support for this release line stops anyway in June 2026. So my best recommendation is only to migrate to 2025.06 where these problems do not exist anymore.

By looking at the mentioned violations I can make the following statements:

  1. CVE-2025-66516, CVE-2025-54988 have been analyzed, and they do not cause problems for DS server. These violations are fixed in 2025.06 regardless of Solr status.
  2. CVE-2025-12383 (org.glassfish.jersey.core:jersey-client) is a client from DS server to Solr. The client is embedded and cannot be easily corrupted by attacker.
  3. CVE-2024-4756 (org.apache.avro:avro) is dragged into dependencies because of Hadoop and Kafka support. It is not used in DS cases. It should not impact you.

I hope that this helps you navigate in the current options.