docker.io/library/solr:9.10.0
Base OS: ubuntu 22.04153 vulnerabilities fixed
Patched Image
ghcr.io/verity-org/library/solr:9.10.0
Supply Chain
Full compliance detailsSignedSLSA L3SBOMRekor
Verify this artifact
Cosign signature
cosign verify \ --certificate-identity-regexp "https://github.com/verity-org/verity/.github/workflows/" \ --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \ ghcr.io/verity-org/library/solr:9.10.0
Build provenance
gh attestation verify \ oci://ghcr.io/verity-org/library/solr:9.10.0 \ --owner verity-org
Before patching
Found 292 vulnerabilities in the original image. 153 fixed by Copa. 139 remaining after patching.
11 CRITICAL39 HIGH146 MEDIUM96 LOW
Fix available — pending patch
These vulnerabilities have upstream fixes but could not be automatically patched. Manual remediation may be required.
- CVE-2024-47561CRITICAL
- Package
- org.apache.avro:avro
- Installed
- 1.9.2
- Fixed
- 1.11.4
- CVE-2026-40682CRITICAL
- Package
- org.apache.opennlp:opennlp-tools
- Installed
- 1.9.4
- Fixed
- 2.5.9, 3.0.0-M3
- CVE-2026-40682CRITICAL
- Package
- org.apache.opennlp:opennlp-tools
- Installed
- 1.9.4
- Fixed
- 2.5.9, 3.0.0-M3
- CVE-2026-40682CRITICAL
- Package
- org.apache.opennlp:opennlp-tools
- Installed
- 1.9.4
- Fixed
- 2.5.9, 3.0.0-M3
- CVE-2026-42027CRITICAL
- Package
- org.apache.opennlp:opennlp-tools
- Installed
- 1.9.4
- Fixed
- 2.5.9, 3.0.0-M3
- CVE-2026-42027CRITICAL
- Package
- org.apache.opennlp:opennlp-tools
- Installed
- 1.9.4
- Fixed
- 2.5.9, 3.0.0-M3
- CVE-2026-42027CRITICAL
- Package
- org.apache.opennlp:opennlp-tools
- Installed
- 1.9.4
- Fixed
- 2.5.9, 3.0.0-M3
- CVE-2025-66516CRITICAL
- Package
- org.apache.tika:tika-core
- Installed
- 1.28.5
- Fixed
- 3.2.2
- CVE-2025-66516CRITICAL
- Package
- org.apache.tika:tika-core
- Installed
- 1.28.5
- Fixed
- 3.2.2
- CVE-2025-54988CRITICAL
- Package
- org.apache.tika:tika-parsers
- Installed
- 1.28.5
- Fixed
- 2.0.0-ALPHA
- CVE-2025-66516CRITICAL
- Package
- org.apache.tika:tika-parsers
- Installed
- 1.28.5
- Fixed
- 2.0.0
- CVE-2025-52999HIGH
- Package
- com.fasterxml.jackson.core:jackson-core
- Installed
- 2.12.7
- Fixed
- 2.15.0
- CVE-2026-54512HIGH
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.12.7.1
- Fixed
- 2.18.8, 3.1.4, 2.21.4
- CVE-2026-54513HIGH
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.12.7.1
- Fixed
- 2.18.8, 2.21.4, 3.1.4
- CVE-2026-54512HIGH
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.18.0
- Fixed
- 2.18.8, 3.1.4, 2.21.4
- CVE-2026-54513HIGH
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.18.0
- Fixed
- 2.18.8, 2.21.4, 3.1.4
- CVE-2026-27830HIGH
- Package
- com.mchange:c3p0
- Installed
- 0.9.5.5
- Fixed
- 0.12.0
- CVE-2026-27727HIGH
- Package
- com.mchange:mchange-commons-java
- Installed
- 0.2.19
- Fixed
- 0.4.0
- CVE-2025-48734HIGH
- Package
- commons-beanutils:commons-beanutils
- Installed
- 1.9.4
- Fixed
- 1.11.0
- CVE-2025-48734HIGH
- Package
- commons-beanutils:commons-beanutils
- Installed
- 1.9.4
- Fixed
- 1.11.0
- CVE-2025-55163HIGH
- Package
- io.grpc:grpc-netty-shaded
- Installed
- 1.65.1
- Fixed
- 1.75.0
- CVE-2026-42583HIGH
- Package
- io.netty:netty-codec-compression
- Installed
- 4.2.6.Final
- Fixed
- 4.2.13.Final
- CVE-2026-33870HIGH
- Package
- io.netty:netty-codec-http
- Installed
- 4.2.6.Final
- Fixed
- 4.1.132.Final, 4.2.10.Final
- CVE-2026-42584HIGH
- Package
- io.netty:netty-codec-http
- Installed
- 4.2.6.Final
- Fixed
- 4.2.13.Final, 4.1.133.Final
- CVE-2026-42587HIGH
- Package
- io.netty:netty-codec-http
- Installed
- 4.2.6.Final
- Fixed
- 4.2.13.Final, 4.1.133.Final
- CVE-2026-33871HIGH
- Package
- io.netty:netty-codec-http2
- Installed
- 4.2.6.Final
- Fixed
- 4.1.132.Final, 4.2.11.Final
- CVE-2026-42587HIGH
- Package
- io.netty:netty-codec-http2
- Installed
- 4.2.6.Final
- Fixed
- 4.2.13.Final, 4.1.133.Final
- CVE-2026-44249HIGH
- Package
- io.netty:netty-handler
- Installed
- 4.2.6.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-45416HIGH
- Package
- io.netty:netty-handler
- Installed
- 4.2.6.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-50010HIGH
- Package
- io.netty:netty-handler
- Installed
- 4.2.6.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-42577HIGH
- Package
- io.netty:netty-transport-native-epoll
- Installed
- 4.2.6.Final
- Fixed
- 4.2.13.Final
- CVE-2023-39410HIGH
- Package
- org.apache.avro:avro
- Installed
- 1.9.2
- Fixed
- 1.11.3
- CVE-2026-35554HIGH
- Package
- org.apache.kafka:kafka-clients
- Installed
- 3.9.1
- Fixed
- 3.9.2, 4.0.2, 4.1.2
- CVE-2026-42440HIGH
- Package
- org.apache.opennlp:opennlp-tools
- Installed
- 1.9.4
- Fixed
- 2.5.9, 3.0.0-M3
- CVE-2026-42440HIGH
- Package
- org.apache.opennlp:opennlp-tools
- Installed
- 1.9.4
- Fixed
- 2.5.9, 3.0.0-M3
- CVE-2026-42440HIGH
- Package
- org.apache.opennlp:opennlp-tools
- Installed
- 1.9.4
- Fixed
- 2.5.9, 3.0.0-M3
- CVE-2026-22022HIGH
- Package
- org.apache.solr:solr-core
- Installed
- 9.10.0
- Fixed
- 9.10.1
- CVE-2026-22444HIGH
- Package
- org.apache.solr:solr-core
- Installed
- 9.10.0
- Fixed
- 9.10.1
- CVE-2026-43869HIGH
- Package
- org.apache.thrift:libthrift
- Installed
- 0.15.0
- Fixed
- 0.23.0
- CVE-2026-24281HIGH
- Package
- org.apache.zookeeper:zookeeper
- Installed
- 3.9.4
- Fixed
- 3.8.6, 3.9.5
- CVE-2026-24308HIGH
- Package
- org.apache.zookeeper:zookeeper
- Installed
- 3.9.4
- Fixed
- 3.9.5, 3.8.6
- CVE-2026-2332HIGH
- Package
- org.eclipse.jetty:jetty-http
- Installed
- 10.0.26
- Fixed
- 12.1.7, 12.0.33
- CVE-2026-2332HIGH
- Package
- org.eclipse.jetty:jetty-http
- Installed
- 9.4.53.v20231009
- Fixed
- 12.1.7, 12.0.33
- GHSA-2r2c-cx56-8933HIGH
- Package
- org.jline:jline-remote-telnet
- Installed
- 3.9.0
- Fixed
- 4.2.1
- GHSA-47qp-hqvx-6r3fHIGH
- Package
- org.jline:jline-remote-telnet
- Installed
- 3.9.0
- Fixed
- 4.2.1
- CVE-2025-12183HIGH
- Package
- org.lz4:lz4-java
- Installed
- 1.8.0
- Fixed
- 1.8.1
- CVE-2025-49128MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-core
- Installed
- 2.12.7
- Fixed
- 2.13.0
- GHSA-72hv-8253-57qqMEDIUM
- Package
- com.fasterxml.jackson.core:jackson-core
- Installed
- 2.12.7
- Fixed
- 2.21.1, 2.18.6
- GHSA-72hv-8253-57qqMEDIUM
- Package
- com.fasterxml.jackson.core:jackson-core
- Installed
- 2.18.0
- Fixed
- 2.21.1, 2.18.6
- CVE-2026-50193MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.12.7.1
- Fixed
- 2.14.0
- CVE-2026-54514MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.12.7.1
- Fixed
- 2.18.8, 2.21.4, 3.1.4
- CVE-2026-54515MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.12.7.1
- Fixed
- 3.1.4, 2.18.9, 2.21.5, 2.22.1
- CVE-2026-54514MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.18.0
- Fixed
- 2.18.8, 2.21.4, 3.1.4
- CVE-2026-54515MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.18.0
- Fixed
- 3.1.4, 2.18.9, 2.21.5, 2.22.1
- CVE-2026-28208MEDIUM
- Package
- com.github.junrar:junrar
- Installed
- 7.5.3
- Fixed
- 7.5.8
- CVE-2026-41245MEDIUM
- Package
- com.github.junrar:junrar
- Installed
- 7.5.3
- Fixed
- 7.5.10
- CVE-2025-53864MEDIUM
- Package
- com.nimbusds:nimbus-jose-jwt
- Installed
- 9.37.2
- Fixed
- 10.0.2, 9.37.4
- CVE-2025-67735MEDIUM
- Package
- io.netty:netty-codec-http
- Installed
- 4.2.6.Final
- Fixed
- 4.2.8.Final, 4.1.129.Final
- CVE-2026-41417MEDIUM
- Package
- io.netty:netty-codec-http
- Installed
- 4.2.6.Final
- Fixed
- 4.1.133.Final, 4.2.13.Final
- CVE-2026-42580MEDIUM
- Package
- io.netty:netty-codec-http
- Installed
- 4.2.6.Final
- Fixed
- 4.2.13.Final, 4.1.133.Final
- CVE-2026-42581MEDIUM
- Package
- io.netty:netty-codec-http
- Installed
- 4.2.6.Final
- Fixed
- 4.2.13.Final, 4.1.133.Final
- CVE-2026-42585MEDIUM
- Package
- io.netty:netty-codec-http
- Installed
- 4.2.6.Final
- Fixed
- 4.2.13.Final, 4.1.133.Final
- CVE-2026-50020MEDIUM
- Package
- io.netty:netty-codec-http
- Installed
- 4.2.6.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-47244MEDIUM
- Package
- io.netty:netty-codec-http2
- Installed
- 4.2.6.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-48043MEDIUM
- Package
- io.netty:netty-codec-http2
- Installed
- 4.2.6.Final
- Fixed
- 4.1.135.Final, 4.2.15.Final
- CVE-2026-50560MEDIUM
- Package
- io.netty:netty-codec-http2
- Installed
- 4.2.6.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-45536MEDIUM
- Package
- io.netty:netty-transport-native-epoll
- Installed
- 4.2.6.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-45292MEDIUM
- Package
- io.opentelemetry:opentelemetry-api
- Installed
- 1.53.0
- Fixed
- 1.62.0
- CVE-2026-46718MEDIUM
- Package
- org.apache.calcite:calcite-core
- Installed
- 1.37.0
- Fixed
- 1.42.0
- CVE-2026-45205MEDIUM
- Package
- org.apache.commons:commons-configuration2
- Installed
- 2.10.1
- Fixed
- 2.15.0
- CVE-2026-45205MEDIUM
- Package
- org.apache.commons:commons-configuration2
- Installed
- 2.12.0
- Fixed
- 2.15.0
- CVE-2025-48924MEDIUM
- Package
- org.apache.commons:commons-lang3
- Installed
- 3.12.0
- Fixed
- 3.18.0
- CVE-2024-21742MEDIUM
- Package
- org.apache.james:apache-mime4j-core
- Installed
- 0.8.4
- Fixed
- 0.8.10
- CVE-2026-33558MEDIUM
- Package
- org.apache.kafka:kafka-clients
- Installed
- 3.9.1
- Fixed
- 3.9.2, 4.0.1
- CVE-2026-34479MEDIUM
- Package
- org.apache.logging.log4j:log4j-1.2-api
- Installed
- 2.21.0
- Fixed
- 2.25.4
- CVE-2025-68161MEDIUM
- Package
- org.apache.logging.log4j:log4j-core
- Installed
- 2.21.0
- Fixed
- 2.25.3
- CVE-2026-34477MEDIUM
- Package
- org.apache.logging.log4j:log4j-core
- Installed
- 2.21.0
- Fixed
- 2.25.4
- CVE-2026-34478MEDIUM
- Package
- org.apache.logging.log4j:log4j-core
- Installed
- 2.21.0
- Fixed
- 2.25.4
- CVE-2026-34480MEDIUM
- Package
- org.apache.logging.log4j:log4j-core
- Installed
- 2.21.0
- Fixed
- 2.25.4
- CVE-2026-34481MEDIUM
- Package
- org.apache.logging.log4j:log4j-layout-template-json
- Installed
- 2.21.0
- Fixed
- 2.25.4
- CVE-2025-31672MEDIUM
- Package
- org.apache.poi:poi-ooxml
- Installed
- 5.2.2
- Fixed
- 5.4.0
- CVE-2025-68280MEDIUM
- Package
- org.apache.sis.core:sis-metadata
- Installed
- 1.2
- Fixed
- 1.6
- CVE-2025-8916MEDIUM
- Package
- org.bouncycastle:bcpkix-jdk15on
- Installed
- 1.70
- Fixed
- 1.79
- CVE-2026-5588MEDIUM
- Package
- org.bouncycastle:bcpkix-jdk15on
- Installed
- 1.70
- Fixed
- 1.84
- CVE-2024-29857MEDIUM
- Package
- org.bouncycastle:bcprov-jdk15on
- Installed
- 1.70
- Fixed
- 1.78
- CVE-2024-30171MEDIUM
- Package
- org.bouncycastle:bcprov-jdk15on
- Installed
- 1.70
- Fixed
- 1.78
- CVE-2024-34447MEDIUM
- Package
- org.bouncycastle:bcprov-jdk15on
- Installed
- 1.70
- Fixed
- 1.78
- CVE-2024-6763MEDIUM
- Package
- org.eclipse.jetty:jetty-http
- Installed
- 10.0.26
- Fixed
- 12.0.12
- CVE-2024-6763MEDIUM
- Package
- org.eclipse.jetty:jetty-http
- Installed
- 9.4.53.v20231009
- Fixed
- 12.0.12
- CVE-2026-42578LOW
- Package
- io.netty:netty-handler-proxy
- Installed
- 4.2.6.Final
- Fixed
- 4.1.133.Final, 4.2.13.Final
- CVE-2025-11143LOW
- Package
- org.eclipse.jetty:jetty-http
- Installed
- 10.0.26
- Fixed
- 12.0.31, 12.1.5
- CVE-2025-11143LOW
- Package
- org.eclipse.jetty:jetty-http
- Installed
- 9.4.53.v20231009
- Fixed
- 12.0.31, 12.1.5
| ID | Package | Installed | Fixed | Severity |
|---|---|---|---|---|
| CVE-2024-47561 | org.apache.avro:avro | 1.9.2 | 1.11.4 | CRITICAL |
| CVE-2026-40682 | org.apache.opennlp:opennlp-tools | 1.9.4 | 2.5.9, 3.0.0-M3 | CRITICAL |
| CVE-2026-40682 | org.apache.opennlp:opennlp-tools | 1.9.4 | 2.5.9, 3.0.0-M3 | CRITICAL |
| CVE-2026-40682 | org.apache.opennlp:opennlp-tools | 1.9.4 | 2.5.9, 3.0.0-M3 | CRITICAL |
| CVE-2026-42027 | org.apache.opennlp:opennlp-tools | 1.9.4 | 2.5.9, 3.0.0-M3 | CRITICAL |
| CVE-2026-42027 | org.apache.opennlp:opennlp-tools | 1.9.4 | 2.5.9, 3.0.0-M3 | CRITICAL |
| CVE-2026-42027 | org.apache.opennlp:opennlp-tools | 1.9.4 | 2.5.9, 3.0.0-M3 | CRITICAL |
| CVE-2025-66516 | org.apache.tika:tika-core | 1.28.5 | 3.2.2 | CRITICAL |
| CVE-2025-66516 | org.apache.tika:tika-core | 1.28.5 | 3.2.2 | CRITICAL |
| CVE-2025-54988 | org.apache.tika:tika-parsers | 1.28.5 | 2.0.0-ALPHA | CRITICAL |
| CVE-2025-66516 | org.apache.tika:tika-parsers | 1.28.5 | 2.0.0 | CRITICAL |
| CVE-2025-52999 | com.fasterxml.jackson.core:jackson-core | 2.12.7 | 2.15.0 | HIGH |
| CVE-2026-54512 | com.fasterxml.jackson.core:jackson-databind | 2.12.7.1 | 2.18.8, 3.1.4, 2.21.4 | HIGH |
| CVE-2026-54513 | com.fasterxml.jackson.core:jackson-databind | 2.12.7.1 | 2.18.8, 2.21.4, 3.1.4 | HIGH |
| CVE-2026-54512 | com.fasterxml.jackson.core:jackson-databind | 2.18.0 | 2.18.8, 3.1.4, 2.21.4 | HIGH |
| CVE-2026-54513 | com.fasterxml.jackson.core:jackson-databind | 2.18.0 | 2.18.8, 2.21.4, 3.1.4 | HIGH |
| CVE-2026-27830 | com.mchange:c3p0 | 0.9.5.5 | 0.12.0 | HIGH |
| CVE-2026-27727 | com.mchange:mchange-commons-java | 0.2.19 | 0.4.0 | HIGH |
| CVE-2025-48734 | commons-beanutils:commons-beanutils | 1.9.4 | 1.11.0 | HIGH |
| CVE-2025-48734 | commons-beanutils:commons-beanutils | 1.9.4 | 1.11.0 | HIGH |
| CVE-2025-55163 | io.grpc:grpc-netty-shaded | 1.65.1 | 1.75.0 | HIGH |
| CVE-2026-42583 | io.netty:netty-codec-compression | 4.2.6.Final | 4.2.13.Final | HIGH |
| CVE-2026-33870 | io.netty:netty-codec-http | 4.2.6.Final | 4.1.132.Final, 4.2.10.Final | HIGH |
| CVE-2026-42584 | io.netty:netty-codec-http | 4.2.6.Final | 4.2.13.Final, 4.1.133.Final | HIGH |
| CVE-2026-42587 | io.netty:netty-codec-http | 4.2.6.Final | 4.2.13.Final, 4.1.133.Final | HIGH |
| CVE-2026-33871 | io.netty:netty-codec-http2 | 4.2.6.Final | 4.1.132.Final, 4.2.11.Final | HIGH |
| CVE-2026-42587 | io.netty:netty-codec-http2 | 4.2.6.Final | 4.2.13.Final, 4.1.133.Final | HIGH |
| CVE-2026-44249 | io.netty:netty-handler | 4.2.6.Final | 4.2.15.Final, 4.1.135.Final | HIGH |
| CVE-2026-45416 | io.netty:netty-handler | 4.2.6.Final | 4.2.15.Final, 4.1.135.Final | HIGH |
| CVE-2026-50010 | io.netty:netty-handler | 4.2.6.Final | 4.2.15.Final, 4.1.135.Final | HIGH |
| CVE-2026-42577 | io.netty:netty-transport-native-epoll | 4.2.6.Final | 4.2.13.Final | HIGH |
| CVE-2023-39410 | org.apache.avro:avro | 1.9.2 | 1.11.3 | HIGH |
| CVE-2026-35554 | org.apache.kafka:kafka-clients | 3.9.1 | 3.9.2, 4.0.2, 4.1.2 | HIGH |
| CVE-2026-42440 | org.apache.opennlp:opennlp-tools | 1.9.4 | 2.5.9, 3.0.0-M3 | HIGH |
| CVE-2026-42440 | org.apache.opennlp:opennlp-tools | 1.9.4 | 2.5.9, 3.0.0-M3 | HIGH |
| CVE-2026-42440 | org.apache.opennlp:opennlp-tools | 1.9.4 | 2.5.9, 3.0.0-M3 | HIGH |
| CVE-2026-22022 | org.apache.solr:solr-core | 9.10.0 | 9.10.1 | HIGH |
| CVE-2026-22444 | org.apache.solr:solr-core | 9.10.0 | 9.10.1 | HIGH |
| CVE-2026-43869 | org.apache.thrift:libthrift | 0.15.0 | 0.23.0 | HIGH |
| CVE-2026-24281 | org.apache.zookeeper:zookeeper | 3.9.4 | 3.8.6, 3.9.5 | HIGH |
| CVE-2026-24308 | org.apache.zookeeper:zookeeper | 3.9.4 | 3.9.5, 3.8.6 | HIGH |
| CVE-2026-2332 | org.eclipse.jetty:jetty-http | 10.0.26 | 12.1.7, 12.0.33 | HIGH |
| CVE-2026-2332 | org.eclipse.jetty:jetty-http | 9.4.53.v20231009 | 12.1.7, 12.0.33 | HIGH |
| GHSA-2r2c-cx56-8933 | org.jline:jline-remote-telnet | 3.9.0 | 4.2.1 | HIGH |
| GHSA-47qp-hqvx-6r3f | org.jline:jline-remote-telnet | 3.9.0 | 4.2.1 | HIGH |
| CVE-2025-12183 | org.lz4:lz4-java | 1.8.0 | 1.8.1 | HIGH |
| CVE-2025-49128 | com.fasterxml.jackson.core:jackson-core | 2.12.7 | 2.13.0 | MEDIUM |
| GHSA-72hv-8253-57qq | com.fasterxml.jackson.core:jackson-core | 2.12.7 | 2.21.1, 2.18.6 | MEDIUM |
| GHSA-72hv-8253-57qq | com.fasterxml.jackson.core:jackson-core | 2.18.0 | 2.21.1, 2.18.6 | MEDIUM |
| CVE-2026-50193 | com.fasterxml.jackson.core:jackson-databind | 2.12.7.1 | 2.14.0 | MEDIUM |
| CVE-2026-54514 | com.fasterxml.jackson.core:jackson-databind | 2.12.7.1 | 2.18.8, 2.21.4, 3.1.4 | MEDIUM |
| CVE-2026-54515 | com.fasterxml.jackson.core:jackson-databind | 2.12.7.1 | 3.1.4, 2.18.9, 2.21.5, 2.22.1 | MEDIUM |
| CVE-2026-54514 | com.fasterxml.jackson.core:jackson-databind | 2.18.0 | 2.18.8, 2.21.4, 3.1.4 | MEDIUM |
| CVE-2026-54515 | com.fasterxml.jackson.core:jackson-databind | 2.18.0 | 3.1.4, 2.18.9, 2.21.5, 2.22.1 | MEDIUM |
| CVE-2026-28208 | com.github.junrar:junrar | 7.5.3 | 7.5.8 | MEDIUM |
| CVE-2026-41245 | com.github.junrar:junrar | 7.5.3 | 7.5.10 | MEDIUM |
| CVE-2025-53864 | com.nimbusds:nimbus-jose-jwt | 9.37.2 | 10.0.2, 9.37.4 | MEDIUM |
| CVE-2025-67735 | io.netty:netty-codec-http | 4.2.6.Final | 4.2.8.Final, 4.1.129.Final | MEDIUM |
| CVE-2026-41417 | io.netty:netty-codec-http | 4.2.6.Final | 4.1.133.Final, 4.2.13.Final | MEDIUM |
| CVE-2026-42580 | io.netty:netty-codec-http | 4.2.6.Final | 4.2.13.Final, 4.1.133.Final | MEDIUM |
| CVE-2026-42581 | io.netty:netty-codec-http | 4.2.6.Final | 4.2.13.Final, 4.1.133.Final | MEDIUM |
| CVE-2026-42585 | io.netty:netty-codec-http | 4.2.6.Final | 4.2.13.Final, 4.1.133.Final | MEDIUM |
| CVE-2026-50020 | io.netty:netty-codec-http | 4.2.6.Final | 4.2.15.Final, 4.1.135.Final | MEDIUM |
| CVE-2026-47244 | io.netty:netty-codec-http2 | 4.2.6.Final | 4.2.15.Final, 4.1.135.Final | MEDIUM |
| CVE-2026-48043 | io.netty:netty-codec-http2 | 4.2.6.Final | 4.1.135.Final, 4.2.15.Final | MEDIUM |
| CVE-2026-50560 | io.netty:netty-codec-http2 | 4.2.6.Final | 4.2.15.Final, 4.1.135.Final | MEDIUM |
| CVE-2026-45536 | io.netty:netty-transport-native-epoll | 4.2.6.Final | 4.2.15.Final, 4.1.135.Final | MEDIUM |
| CVE-2026-45292 | io.opentelemetry:opentelemetry-api | 1.53.0 | 1.62.0 | MEDIUM |
| CVE-2026-46718 | org.apache.calcite:calcite-core | 1.37.0 | 1.42.0 | MEDIUM |
| CVE-2026-45205 | org.apache.commons:commons-configuration2 | 2.10.1 | 2.15.0 | MEDIUM |
| CVE-2026-45205 | org.apache.commons:commons-configuration2 | 2.12.0 | 2.15.0 | MEDIUM |
| CVE-2025-48924 | org.apache.commons:commons-lang3 | 3.12.0 | 3.18.0 | MEDIUM |
| CVE-2024-21742 | org.apache.james:apache-mime4j-core | 0.8.4 | 0.8.10 | MEDIUM |
| CVE-2026-33558 | org.apache.kafka:kafka-clients | 3.9.1 | 3.9.2, 4.0.1 | MEDIUM |
| CVE-2026-34479 | org.apache.logging.log4j:log4j-1.2-api | 2.21.0 | 2.25.4 | MEDIUM |
| CVE-2025-68161 | org.apache.logging.log4j:log4j-core | 2.21.0 | 2.25.3 | MEDIUM |
| CVE-2026-34477 | org.apache.logging.log4j:log4j-core | 2.21.0 | 2.25.4 | MEDIUM |
| CVE-2026-34478 | org.apache.logging.log4j:log4j-core | 2.21.0 | 2.25.4 | MEDIUM |
| CVE-2026-34480 | org.apache.logging.log4j:log4j-core | 2.21.0 | 2.25.4 | MEDIUM |
| CVE-2026-34481 | org.apache.logging.log4j:log4j-layout-template-json | 2.21.0 | 2.25.4 | MEDIUM |
| CVE-2025-31672 | org.apache.poi:poi-ooxml | 5.2.2 | 5.4.0 | MEDIUM |
| CVE-2025-68280 | org.apache.sis.core:sis-metadata | 1.2 | 1.6 | MEDIUM |
| CVE-2025-8916 | org.bouncycastle:bcpkix-jdk15on | 1.70 | 1.79 | MEDIUM |
| CVE-2026-5588 | org.bouncycastle:bcpkix-jdk15on | 1.70 | 1.84 | MEDIUM |
| CVE-2024-29857 | org.bouncycastle:bcprov-jdk15on | 1.70 | 1.78 | MEDIUM |
| CVE-2024-30171 | org.bouncycastle:bcprov-jdk15on | 1.70 | 1.78 | MEDIUM |
| CVE-2024-34447 | org.bouncycastle:bcprov-jdk15on | 1.70 | 1.78 | MEDIUM |
| CVE-2024-6763 | org.eclipse.jetty:jetty-http | 10.0.26 | 12.0.12 | MEDIUM |
| CVE-2024-6763 | org.eclipse.jetty:jetty-http | 9.4.53.v20231009 | 12.0.12 | MEDIUM |
| CVE-2026-42578 | io.netty:netty-handler-proxy | 4.2.6.Final | 4.1.133.Final, 4.2.13.Final | LOW |
| CVE-2025-11143 | org.eclipse.jetty:jetty-http | 10.0.26 | 12.0.31, 12.1.5 | LOW |
| CVE-2025-11143 | org.eclipse.jetty:jetty-http | 9.4.53.v20231009 | 12.0.31, 12.1.5 | LOW |
Awaiting upstream fix
No fix is available yet for these vulnerabilities. They can be suppressed in your compliance tooling until an upstream fix is released.
- CVE-2026-44825HIGH
- Package
- org.apache.solr:solr-core
- Installed
- 9.10.0
- Fixed
- CVE-2025-66566HIGH
- Package
- org.lz4:lz4-java
- Installed
- 1.8.0
- Fixed
- CVE-2026-27456MEDIUM
- Package
- bsdutils
- Installed
- 1:2.37.2-4ubuntu3.4
- Fixed
- CVE-2026-27456MEDIUM
- Package
- libblkid1
- Installed
- 2.37.2-4ubuntu3.4
- Fixed
- CVE-2026-4046MEDIUM
- Package
- libc-bin
- Installed
- 2.35-0ubuntu3.13
- Fixed
- CVE-2026-5435MEDIUM
- Package
- libc-bin
- Installed
- 2.35-0ubuntu3.13
- Fixed
- CVE-2026-6238MEDIUM
- Package
- libc-bin
- Installed
- 2.35-0ubuntu3.13
- Fixed
- CVE-2026-4046MEDIUM
- Package
- libc6
- Installed
- 2.35-0ubuntu3.13
- Fixed
- CVE-2026-5435MEDIUM
- Package
- libc6
- Installed
- 2.35-0ubuntu3.13
- Fixed
- CVE-2026-6238MEDIUM
- Package
- libc6
- Installed
- 2.35-0ubuntu3.13
- Fixed
- CVE-2025-66382MEDIUM
- Package
- libexpat1
- Installed
- 2.4.7-1ubuntu0.7
- Fixed
- CVE-2026-27456MEDIUM
- Package
- libmount1
- Installed
- 2.37.2-4ubuntu3.4
- Fixed
- CVE-2026-13757MEDIUM
- Package
- libp11-kit0
- Installed
- 0.24.0-6build1
- Fixed
- CVE-2026-40930MEDIUM
- Package
- libpng16-16
- Installed
- 1.6.37-3ubuntu0.5
- Fixed
- CVE-2026-27456MEDIUM
- Package
- libsmartcols1
- Installed
- 2.37.2-4ubuntu3.4
- Fixed
- CVE-2026-27456MEDIUM
- Package
- libuuid1
- Installed
- 2.37.2-4ubuntu3.4
- Fixed
- CVE-2026-4046MEDIUM
- Package
- locales
- Installed
- 2.35-0ubuntu3.13
- Fixed
- CVE-2026-5435MEDIUM
- Package
- locales
- Installed
- 2.35-0ubuntu3.13
- Fixed
- CVE-2026-6238MEDIUM
- Package
- locales
- Installed
- 2.35-0ubuntu3.13
- Fixed
- CVE-2026-27456MEDIUM
- Package
- mount
- Installed
- 2.37.2-4ubuntu3.4
- Fixed
- CVE-2026-13757MEDIUM
- Package
- p11-kit
- Installed
- 0.24.0-6build1
- Fixed
- CVE-2026-13757MEDIUM
- Package
- p11-kit-modules
- Installed
- 0.24.0-6build1
- Fixed
- CVE-2026-27456MEDIUM
- Package
- util-linux
- Installed
- 2.37.2-4ubuntu3.4
- Fixed
- CVE-2021-31879MEDIUM
- Package
- wget
- Installed
- 1.21.2-2ubuntu1.1
- Fixed
- CVE-2026-58469MEDIUM
- Package
- wget
- Installed
- 1.21.2-2ubuntu1.1
- Fixed
- CVE-2026-58470MEDIUM
- Package
- wget
- Installed
- 1.21.2-2ubuntu1.1
- Fixed
- CVE-2026-58471MEDIUM
- Package
- wget
- Installed
- 1.21.2-2ubuntu1.1
- Fixed
- CVE-2026-58472MEDIUM
- Package
- wget
- Installed
- 1.21.2-2ubuntu1.1
- Fixed
- CVE-2023-33201MEDIUM
- Package
- org.bouncycastle:bcprov-jdk15on
- Installed
- 1.70
- Fixed
- CVE-2022-27943LOW
- Package
- gcc-12-base
- Installed
- 12.3.0-1ubuntu1~22.04.2
- Fixed
- CVE-2022-27943LOW
- Package
- libgcc-s1
- Installed
- 12.3.0-1ubuntu1~22.04.2
- Fixed
- CVE-2024-2236LOW
- Package
- libgcrypt20
- Installed
- 1.9.4-3ubuntu3.2
- Fixed
- CVE-2023-50495LOW
- Package
- libncurses6
- Installed
- 6.3-2ubuntu0.2
- Fixed
- CVE-2023-50495LOW
- Package
- libncursesw6
- Installed
- 6.3-2ubuntu0.2
- Fixed
- CVE-2022-41409LOW
- Package
- libpcre2-8-0
- Installed
- 10.39-3ubuntu0.1
- Fixed
- CVE-2017-11164LOW
- Package
- libpcre3
- Installed
- 2:8.39-13ubuntu0.22.04.1
- Fixed
- CVE-2022-27943LOW
- Package
- libstdc++6
- Installed
- 12.3.0-1ubuntu1~22.04.2
- Fixed
- CVE-2026-40228LOW
- Package
- libsystemd0
- Installed
- 249.11-0ubuntu3.21
- Fixed
- CVE-2023-50495LOW
- Package
- libtinfo6
- Installed
- 6.3-2ubuntu0.2
- Fixed
- CVE-2026-40228LOW
- Package
- libudev1
- Installed
- 249.11-0ubuntu3.21
- Fixed
- CVE-2022-4899LOW
- Package
- libzstd1
- Installed
- 1.4.8+dfsg-3build1
- Fixed
- CVE-2023-29383LOW
- Package
- login
- Installed
- 1:4.8.1-2ubuntu2.2
- Fixed
- CVE-2024-56433LOW
- Package
- login
- Installed
- 1:4.8.1-2ubuntu2.2
- Fixed
- CVE-2023-50495LOW
- Package
- ncurses-base
- Installed
- 6.3-2ubuntu0.2
- Fixed
- CVE-2023-50495LOW
- Package
- ncurses-bin
- Installed
- 6.3-2ubuntu0.2
- Fixed
- CVE-2023-29383LOW
- Package
- passwd
- Installed
- 1:4.8.1-2ubuntu2.2
- Fixed
- CVE-2024-56433LOW
- Package
- passwd
- Installed
- 1:4.8.1-2ubuntu2.2
- Fixed
| ID | Package | Installed | Fixed | Severity |
|---|---|---|---|---|
| CVE-2026-44825 | org.apache.solr:solr-core | 9.10.0 | HIGH | |
| CVE-2025-66566 | org.lz4:lz4-java | 1.8.0 | HIGH | |
| CVE-2026-27456 | bsdutils | 1:2.37.2-4ubuntu3.4 | MEDIUM | |
| CVE-2026-27456 | libblkid1 | 2.37.2-4ubuntu3.4 | MEDIUM | |
| CVE-2026-4046 | libc-bin | 2.35-0ubuntu3.13 | MEDIUM | |
| CVE-2026-5435 | libc-bin | 2.35-0ubuntu3.13 | MEDIUM | |
| CVE-2026-6238 | libc-bin | 2.35-0ubuntu3.13 | MEDIUM | |
| CVE-2026-4046 | libc6 | 2.35-0ubuntu3.13 | MEDIUM | |
| CVE-2026-5435 | libc6 | 2.35-0ubuntu3.13 | MEDIUM | |
| CVE-2026-6238 | libc6 | 2.35-0ubuntu3.13 | MEDIUM | |
| CVE-2025-66382 | libexpat1 | 2.4.7-1ubuntu0.7 | MEDIUM | |
| CVE-2026-27456 | libmount1 | 2.37.2-4ubuntu3.4 | MEDIUM | |
| CVE-2026-13757 | libp11-kit0 | 0.24.0-6build1 | MEDIUM | |
| CVE-2026-40930 | libpng16-16 | 1.6.37-3ubuntu0.5 | MEDIUM | |
| CVE-2026-27456 | libsmartcols1 | 2.37.2-4ubuntu3.4 | MEDIUM | |
| CVE-2026-27456 | libuuid1 | 2.37.2-4ubuntu3.4 | MEDIUM | |
| CVE-2026-4046 | locales | 2.35-0ubuntu3.13 | MEDIUM | |
| CVE-2026-5435 | locales | 2.35-0ubuntu3.13 | MEDIUM | |
| CVE-2026-6238 | locales | 2.35-0ubuntu3.13 | MEDIUM | |
| CVE-2026-27456 | mount | 2.37.2-4ubuntu3.4 | MEDIUM | |
| CVE-2026-13757 | p11-kit | 0.24.0-6build1 | MEDIUM | |
| CVE-2026-13757 | p11-kit-modules | 0.24.0-6build1 | MEDIUM | |
| CVE-2026-27456 | util-linux | 2.37.2-4ubuntu3.4 | MEDIUM | |
| CVE-2021-31879 | wget | 1.21.2-2ubuntu1.1 | MEDIUM | |
| CVE-2026-58469 | wget | 1.21.2-2ubuntu1.1 | MEDIUM | |
| CVE-2026-58470 | wget | 1.21.2-2ubuntu1.1 | MEDIUM | |
| CVE-2026-58471 | wget | 1.21.2-2ubuntu1.1 | MEDIUM | |
| CVE-2026-58472 | wget | 1.21.2-2ubuntu1.1 | MEDIUM | |
| CVE-2023-33201 | org.bouncycastle:bcprov-jdk15on | 1.70 | MEDIUM | |
| CVE-2022-27943 | gcc-12-base | 12.3.0-1ubuntu1~22.04.2 | LOW | |
| CVE-2022-27943 | libgcc-s1 | 12.3.0-1ubuntu1~22.04.2 | LOW | |
| CVE-2024-2236 | libgcrypt20 | 1.9.4-3ubuntu3.2 | LOW | |
| CVE-2023-50495 | libncurses6 | 6.3-2ubuntu0.2 | LOW | |
| CVE-2023-50495 | libncursesw6 | 6.3-2ubuntu0.2 | LOW | |
| CVE-2022-41409 | libpcre2-8-0 | 10.39-3ubuntu0.1 | LOW | |
| CVE-2017-11164 | libpcre3 | 2:8.39-13ubuntu0.22.04.1 | LOW | |
| CVE-2022-27943 | libstdc++6 | 12.3.0-1ubuntu1~22.04.2 | LOW | |
| CVE-2026-40228 | libsystemd0 | 249.11-0ubuntu3.21 | LOW | |
| CVE-2023-50495 | libtinfo6 | 6.3-2ubuntu0.2 | LOW | |
| CVE-2026-40228 | libudev1 | 249.11-0ubuntu3.21 | LOW | |
| CVE-2022-4899 | libzstd1 | 1.4.8+dfsg-3build1 | LOW | |
| CVE-2023-29383 | login | 1:4.8.1-2ubuntu2.2 | LOW | |
| CVE-2024-56433 | login | 1:4.8.1-2ubuntu2.2 | LOW | |
| CVE-2023-50495 | ncurses-base | 6.3-2ubuntu0.2 | LOW | |
| CVE-2023-50495 | ncurses-bin | 6.3-2ubuntu0.2 | LOW | |
| CVE-2023-29383 | passwd | 1:4.8.1-2ubuntu2.2 | LOW | |
| CVE-2024-56433 | passwd | 1:4.8.1-2ubuntu2.2 | LOW |
Original image reference
docker.io/library/solr:9.10.0