From 41cf600019eadb8c95008ab21aca13397b103fa8 Mon Sep 17 00:00:00 2001
From: Eric Pugh <epugh@opensourceconnections.com>
Date: Sun, 19 Jul 2026 18:36:15 -0300
Subject: [PATCH] Add missing jars field to two dependency VEX entries

CVE-2024-7254 (protobuf-java) and CVE-2025-48924 (commons-lang3) were
missing their `jars` front matter, so they were treated as advisory-only
Solr-native entries and excluded from the dependency-CVE table even
though both are genuine third-party dependency vulnerabilities. Also
fixes the commons-lang3 entry's placeholder title.
---
 content/solr/vex/2025-08-02-cve-2024-7254.md  | 2 ++
 content/solr/vex/2025-08-04-cve-2025-48924.md | 4 +++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/content/solr/vex/2025-08-02-cve-2024-7254.md b/content/solr/vex/2025-08-02-cve-2024-7254.md
index 308ca5d5e..ac2d889ef 100644
--- a/content/solr/vex/2025-08-02-cve-2024-7254.md
+++ b/content/solr/vex/2025-08-02-cve-2024-7254.md
@@ -4,6 +4,8 @@ jira: SOLR-17833
 category:
   - solr/vex
 versions: "≤ 9.9.0"
+jars:
+  - protobuf-java-3.25.3.jar
 analysis:
   state: in_triage
 title: "protobuf-java: Potential Denial of Service issue"
diff --git a/content/solr/vex/2025-08-04-cve-2025-48924.md b/content/solr/vex/2025-08-04-cve-2025-48924.md
index 22cbfd3c5..d5215afef 100644
--- a/content/solr/vex/2025-08-04-cve-2025-48924.md
+++ b/content/solr/vex/2025-08-04-cve-2025-48924.md
@@ -3,9 +3,11 @@ cve: CVE-2025-48924
 category:
   - solr/vex
 versions: "9.0.0-9.9.0"
+jars:
+  - commons-lang3-3.15.0.jar
 analysis:
   state: not_affected
   justification: "code_not_reachable"
-title: "commons-lang3-<version>.jar"
+title: "commons-lang3"
 ---
 The vulnerable functionality is only reachable via `commons-configuration2`, which is used in Solr's Hadoop Kerberos support (`solr-hadoop-auth`) to load administrator-provided Hadoop configuration files. As such, the vulnerability is not exploitable in Solr.