SOLR-18013: Split lz4-java CVEs by fix boundary and emit a matchable org.lz4 purl - #228
Merged
Merged
Conversation
The three lz4-java CVEs were bundled in one entry, but CVE-2026-59949 has a different fix boundary than the SOLR-18013 pair: - CVE-2025-12183 (fix 1.8.1) + CVE-2025-66566 (fix 1.10.1): fixed by the branch_9x/branch_10x/main migration to the fork at.yawk.lz4:lz4-java 1.10.1, so the upcoming 9.11/10.1 are not affected. -> own file, 9.8.0-10.0.0. - CVE-2026-59949 (fix 1.11.1): NOT fixed by the 1.10.1 fork bump; all three dev branches are still on 1.10.1, so 9.11/10.1 will remain affected. -> stays in its own file, range will extend once those release. Also add org.lz4:lz4-java to the dependency map (9.8.0-10.0.0 -> 1.8.0) so these statements emit a matchable pkg:maven/org.lz4/lz4-java@1.8.0 purl instead of a bare, unmatchable id. Disposition unchanged (not_affected; lz4-java is reachable only via the optional cross-dc Kafka client, not from untrusted input). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
epugh
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The three lz4-java CVEs were bundled in a single entry with one range, but CVE-2026-59949 has a different fix boundary than the SOLR-18013 pair, so they need to be separated (per the version-range-driven split convention).
So:
2026-08-13-cve-2025-12183.md— CVE-2025-12183 + CVE-2025-66566,versions: "9.8.0-10.0.0". Both fixed by thebranch_9x/branch_10x/mainmigration to the community forkat.yawk.lz4:lz4-java1.10.1, so 9.11/10.1 won't be affected. (This upgrade didn't require Kafka to update first — Solr replaced Kafka's transitiveorg.lz4:lz4-javawith the fork directly.)2026-07-31-cve-2026-59949.md— reduced to CVE-2026-59949 alone. It needs lz4-java 1.11.1, which is on no branch yet (all three dev branches are on 1.10.1), so 9.11/10.1 will still bundle an affected version and the range will need to extend once they ship.Also adds
org.lz4:lz4-java(9.8.0–10.0.0 → 1.8.0) tosolr-dependency-versions.jsonso both entries now emit a matchablepkg:maven/org.lz4/lz4-java@1.8.0product purl instead of a bare, unmatchable id.lz4-java first shipped in Solr 9.8.0 (via the
cross-dcmodule); ≤9.7.0 and 8.x ship none. Disposition staysnot_affected(reachable only through the optional cross-dc Kafka client, never from untrusted input). Site builds, all three statements emit the correct purl,vexctl mergepasses.