CVE-2026-47898

Critical · CVSS 9.8

Apache Lucene.Net (Lucene.Net.Analysis.Common) — XML External Entity (XXE) Injection

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: other; CWE-611

Description

Improper Restriction of XML External Entity Reference vulnerability in Apache Lucene.Net (Lucene.Net.Analysis.Common library). This issue affects Apache Lucene.Net.Analysis.Common: from 4.8.0-beta00005 before 4.8.0-beta00018. Users are recommended to upgrade to version 4.8.0-beta00018, which fixes the issue.

Search profile — drives PoC discovery

Symbols Lucene.Net.Analysis.CommonXmlReaderXmlTextReaderDtdProcessingProhibitDtdLoadXmlXPathDocumentXmlDocumentXmlReaderSettings

Keywords CVE-2026-47898Lucene.Net XXELucene.Net.Analysis.Common XML External EntityApache Lucene.Net CWE-611Lucene.Net 4.8.0-beta00005 XXELucene.Net.Analysis.Common vulnerabilityLucene.Net XXE proof of conceptLucene.Net XML injection PoC

Versions: 4.8.0-beta00005 to before 4.8.0-beta00018

References

Status: enriched · ingested 2026-07-09T00:00:39.000Z · profiled 2026-07-09T00:30:39.000Z