GCVE - cpe:2.3:a:apache:solr:8.8.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:solr:8.8.1:*:*:*:*:*:*:*

part: a version: 8.8.1 update: *

Vendor	Apache (`b0303047-b7dd-5cf8-abcc-71b7d9d80b95`)
Product	Solr (`e541f611-5f4f-518b-9c5a-edac6afba2d9`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:apache/solr`	purl2cpe	2026-06-01 10:14:26.416940
`pkg:github/apache/solr`	purl2cpe	2026-06-01 10:14:26.416941
`pkg:maven/org.apache.solr/solr`	purl2cpe	2026-06-01 10:14:26.416943
`pkg:maven/org.apache.solr/solrj`	purl2cpe	2026-06-01 10:14:26.416944
`pkg:rpm/opensuse/solr`	purl2cpe	2026-06-01 10:14:26.416946
`pkg:sourceforge/apache-solr`	purl2cpe	2026-06-01 10:14:26.416947

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2021-33813`	vulnerable	2026-06-08 05:32:12.509044	Details available An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request. Published: 2021-06-16T11:18:14.000Z Updated: 2024-08-03T23:58:23.111Z Open on db.gcve.eu Reference links https://github.com/hunterhacker/jdom/pull/188 https://github.com/hunterhacker/jdom/releases https://lists.debian.org/debian-lts-announce/2021/06/msg00026.html https://lists.apache.org/thread.html/r9974f64723875052e02787b2a5eda689ac5247c71b827d455e5dc9a6%40%3Cissues.solr.apache.org%3E https://lists.apache.org/thread.html/rbc075a4ac85e7a8e47420b7383f16ffa0af3b792b8423584735f369f%40%3Cissues.solr.apache.org%3E	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-28163`	vulnerable	2026-06-08 05:31:23.043254	Details available LOW (2.7) In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory. Published: 2021-04-01T14:20:13.000Z Updated: 2024-08-03T21:40:12.280Z Open on db.gcve.eu Reference links https://github.com/eclipse/jetty.project/security/advisories/GHSA-j6qj-j888-vvgq https://lists.apache.org/thread.html/r780c3c210a05c5bf7b4671303f46afc3fe56758e92864e1a5f0590d0%40%3Cjira.kafka.apache.org%3E https://lists.apache.org/thread.html/r5b3693da7ecb8a75c0e930b4ca26a5f97aa0207d9dae4aa8cc65fe6b%40%3Cissues.ignite.apache.org%3E https://lists.apache.org/thread.html/rd7c8fb305a8637480dc943ba08424c8992dccad018cd1405eb2afe0e%40%3Cdev.ignite.apache.org%3E https://lists.apache.org/thread.html/r0841b06b48324cfc81325de3c05a92e53f997185f9d71ff47734d961%40%3Cissues.solr.apache.org%3E	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-27223`	vulnerable	2026-06-08 05:23:52.432176	Details available MEDIUM (5.2) In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values. Published: 2021-02-26T21:55:13.000Z Updated: 2025-08-20T10:03:37.386Z Open on db.gcve.eu Reference links https://bugs.eclipse.org/bugs/show_bug.cgi?id=571128 https://github.com/eclipse/jetty.project/security/advisories/GHSA-m394-8rww-3jr7 https://lists.apache.org/thread.html/r5612dc69e1f79c421faf9764ffbc92591e2a69ea417c04cba57f49ea%40%3Cuser.karaf.apache.org%3E https://lists.apache.org/thread.html/rd8e24a3e482e5984bc8c5492dc790413e4fdc1234e3debb94515796b%40%3Cjira.kafka.apache.org%3E https://lists.apache.org/thread.html/r35ab810c0f3016b3fd3a3fa9088a2d2781b354a810780ce74d022b6c%40%3Cdev.kafka.apache.org%3E	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.