The Solr PMC greatly appreciates responsible disclosure of new security vulnerabilities found in Solr itself or demonstrating exploitation via a dependency. It is important not to publish a previously unknown exploit, or exploit demonstration code, on public mailing lists or issue trackers before coordinating with the PMC.
See the vulnerability reporting procedure for the full reporting rules, the workflow diagram, and what to expect after you report.
Every CVE detected by a scanner is by definition already public knowledge. Before contacting the security team about a dependency CVE, please:
Jira is for discussing specific development modifications. Any Jira that contains only scan report output, or references multiple dependencies at the same time is likely to be ignored or closed. The large number of reports about already-known issues is a serious drag on our volunteer time — please search Jira before opening a new issue.
The five most recent security advisories.
See full security news history →
