diff --git a/content/solr/vex/2025-08-02-cve-2024-7254.md b/content/solr/vex/2025-08-02-cve-2024-7254.md index 308ca5d5e..ac2d889ef 100644 --- a/content/solr/vex/2025-08-02-cve-2024-7254.md +++ b/content/solr/vex/2025-08-02-cve-2024-7254.md @@ -4,6 +4,8 @@ jira: SOLR-17833 category: - solr/vex versions: "≤ 9.9.0" +jars: + - protobuf-java-3.25.3.jar analysis: state: in_triage title: "protobuf-java: Potential Denial of Service issue" diff --git a/content/solr/vex/2025-08-04-cve-2025-48924.md b/content/solr/vex/2025-08-04-cve-2025-48924.md index 22cbfd3c5..d5215afef 100644 --- a/content/solr/vex/2025-08-04-cve-2025-48924.md +++ b/content/solr/vex/2025-08-04-cve-2025-48924.md @@ -3,9 +3,11 @@ cve: CVE-2025-48924 category: - solr/vex versions: "9.0.0-9.9.0" +jars: + - commons-lang3-3.15.0.jar analysis: state: not_affected justification: "code_not_reachable" -title: "commons-lang3-.jar" +title: "commons-lang3" --- The vulnerable functionality is only reachable via `commons-configuration2`, which is used in Solr's Hadoop Kerberos support (`solr-hadoop-auth`) to load administrator-provided Hadoop configuration files. As such, the vulnerability is not exploitable in Solr.