CVE-2026-47898

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-47898
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47898.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-47898
Published
2026-07-03T07:47:38.904Z
Modified
2026-07-15T01:49:05.175512095Z
Severity
  • 4.0 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N CVSS Calculator
Summary
Apache Lucene.Net: XXE vulnerability in Lucene.Net.Analysis.Common PatternParser
Details

Improper Restriction of XML External Entity Reference vulnerability in Apache Lucene.Net (Lucene.Net.Analysis.Common library).

This issue affects Apache Lucene.Net.Analysis.Common: from 4.8.0-beta00005 before 4.8.0-beta00018.

Users are recommended to upgrade to version 4.8.0-beta00018, which fixes the issue.

Database specific 
{
    "cna_assigner": "apache",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47898.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "4.8.0-beta00005"
                },
                {
                    "fixed": "4.8.0-beta00018"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "introduced": "4.8.0-beta00005"
                },
                {
                    "fixed": "4.8.0-beta00018"
                }
            ],
            "source": "DESCRIPTION"
        }
    ],
    "cwe_ids": [
        "CWE-611"
    ]
}
References

Affected packages

Git / github.com/apache/lucenenet

Affected ranges

Type
GIT
Repo
https://github.com/apache/lucenenet
Events
Introduced
ffbe9c3f90297dfbae11c8a3b1dad475821f46b3
Last affected
5784b18a4c11c847bc2c962b7c4cd6d072b5b2a8
Database specific 
{
    "cpe": [
        "cpe:2.3:a:apache:lucene.net:4.8.0:beta00005:*:*:*:*:*:*",
        "cpe:2.3:a:apache:lucene.net:4.8.0:beta00006:*:*:*:*:*:*",
        "cpe:2.3:a:apache:lucene.net:4.8.0:beta00007:*:*:*:*:*:*",
        "cpe:2.3:a:apache:lucene.net:4.8.0:beta00008:*:*:*:*:*:*",
        "cpe:2.3:a:apache:lucene.net:4.8.0:beta00009:*:*:*:*:*:*",
        "cpe:2.3:a:apache:lucene.net:4.8.0:beta00010:*:*:*:*:*:*",
        "cpe:2.3:a:apache:lucene.net:4.8.0:beta00011:*:*:*:*:*:*",
        "cpe:2.3:a:apache:lucene.net:4.8.0:beta00012:*:*:*:*:*:*",
        "cpe:2.3:a:apache:lucene.net:4.8.0:beta00013:*:*:*:*:*:*",
        "cpe:2.3:a:apache:lucene.net:4.8.0:beta00014:*:*:*:*:*:*",
        "cpe:2.3:a:apache:lucene.net:4.8.0:beta00015:*:*:*:*:*:*",
        "cpe:2.3:a:apache:lucene.net:4.8.0:beta00016:*:*:*:*:*:*",
        "cpe:2.3:a:apache:lucene.net:4.8.0:beta00017:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "4.8.0-beta00005"
        },
        {
            "last_affected": "4.8.0-beta00005"
        },
        {
            "introduced": "4.8.0-beta00006"
        },
        {
            "last_affected": "4.8.0-beta00006"
        },
        {
            "introduced": "4.8.0-beta00007"
        },
        {
            "last_affected": "4.8.0-beta00007"
        },
        {
            "introduced": "4.8.0-beta00008"
        },
        {
            "last_affected": "4.8.0-beta00008"
        },
        {
            "introduced": "4.8.0-beta00009"
        },
        {
            "last_affected": "4.8.0-beta00009"
        },
        {
            "introduced": "4.8.0-beta00010"
        },
        {
            "last_affected": "4.8.0-beta00010"
        },
        {
            "introduced": "4.8.0-beta00011"
        },
        {
            "last_affected": "4.8.0-beta00011"
        },
        {
            "introduced": "4.8.0-beta00012"
        },
        {
            "last_affected": "4.8.0-beta00012"
        },
        {
            "introduced": "4.8.0-beta00013"
        },
        {
            "last_affected": "4.8.0-beta00013"
        },
        {
            "introduced": "4.8.0-beta00014"
        },
        {
            "last_affected": "4.8.0-beta00014"
        },
        {
            "introduced": "4.8.0-beta00015"
        },
        {
            "last_affected": "4.8.0-beta00015"
        },
        {
            "introduced": "4.8.0-beta00016"
        },
        {
            "last_affected": "4.8.0-beta00016"
        },
        {
            "introduced": "4.8.0-beta00017"
        },
        {
            "last_affected": "4.8.0-beta00017"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

4.*
4.8.0-beta00005
4.8.0-beta00006
4.8.0-beta00007
4.8.0-beta00008
4.8.0-beta00009
4.8.0-beta00010
4.8.0-beta00011
4.8.0-beta00012
4.8.0-beta00013
4.8.0-beta00014
4.8.0-beta00015
4.8.0-beta00016
4.8.0-beta00017
Lucene.*
Lucene.Net_4_8_0_beta00005
Lucene.Net_4_8_0_beta00006
Lucene.Net_4_8_0_beta00007
Lucene.Net_4_8_0_beta00008
Lucene.Net_4_8_0_beta00009
Lucene.Net_4_8_0_beta00010
Lucene.Net_4_8_0_beta00011
Lucene.Net_4_8_0_beta00012
Lucene.Net_4_8_0_beta00013
Lucene.Net_4_8_0_beta00014
Lucene.Net_4_8_0_beta00015
Lucene.Net_4_8_0_beta00016
Lucene.Net_4_8_0_beta00017

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47898.json"