CVE-2026-47898 Apache Lucene.Net: XXE vulnerability in Lucene.Net.Analysis.Common PatternParser
An attacker can exploit an XML External Entity vulnerability in the Lucene.Net.Analysis.Common library to read sensitive data or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-47898?
CVE-2026-47898 is a medium-severity vulnerability in Apache Lucene.Net, published on 3 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Improper Restriction of XML External Entity Reference vulnerability in Apache Lucene.Net (Lucene.Net.Analysis.Common library).
This issue affects Apache Lucene.Net.Analysis.Common: from 4.8.0-beta00005 before 4.8.0-beta00018.
Users are recommended to upgrade to version 4.8.0-beta00018, which fixes the issue.
Weakness: CWE-611
Which versions are affected by CVE-2026-47898?
It affects 1 product.
Products include Apache Lucene.net.
How do I fix CVE-2026-47898?
No fix has been published for CVE-2026-47898 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-47898 being exploited?
There is no known exploitation of CVE-2026-47898 in the wild and no public exploit code.
Other vulnerabilities in Apache Lucene.Net
- CVE-2026-47896 Apache Lucene.Net: Unauthenticated arbitrary file read on the Lucene.Net.Replicator replication server
- CVE-2026-47897 Apache Lucene.Net: Arbitrary file write from malicious server to Lucene.Net.Replicator client
- CVE-2024-43383 Apache Lucene.Net.Replicator: Remote Code Execution in Lucene.Net.Replicator
Sources
Also known as GHSA-m739-f9cm-66x2.