Is there a patch available for CVE-2026-47898?

Yes, a patch is available for CVE-2026-47898. Update the affected software to the latest version immediately.

Apache Lucene.Net CVE-2026-47898

Q: What is the CVSS score of CVE-2026-47898?

CVE-2026-47898 has a CVSS 4.0 base score of 4.0 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-41517 MEDIUM

Improper Restriction of XML External Entity Reference (CWE-611)

2026-07-03

GHSA-m739-f9cm-66x2

XXE Apache Lucene Net

4.0

CVSS 4.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY

4.0 MEDIUM

CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.5 HIGH

Network vector for typical API/web deployment; PR:L because supplying XML patterns to PatternParser generally requires at least application-level access; S:C and C:H for cross-boundary file read; A:L for potential entity-expansion DoS.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 03, 2026 - 09:01 EUVD

CVSS changed

Jul 03, 2026 - 08:22 NVD

4.0 (MEDIUM)

Analysis Generated

Jul 03, 2026 - 02:16 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

XML External Entity injection in Apache Lucene.Net's PatternParser component (Lucene.Net.Analysis.Common library) allows attackers who can supply XML input to the parser to read arbitrary files from the host filesystem or trigger server-side request forgery. Affected deployments span versions 4.8.0-beta00005 through 4.8.0-beta00017. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the well-understood XXE attack class combined with the availability of a fix version makes patching straightforward and strongly advisable.

Technical ContextAI

Apache Lucene.Net is a .NET port of the Apache Lucene Java search library, widely used for full-text search indexing. The vulnerable component is PatternParser within the Lucene.Net.Analysis.Common library, which parses XML-formatted pattern definitions used to configure text analysis pipelines (e.g., custom tokenizers, synonym filters, and stop-word lists). CWE-611 (Improper Restriction of XML External Entity Reference) describes the root cause: the XML parser was not configured to disable DOCTYPE declarations or external entity resolution. When an XML document containing an entity reference such as <!ENTITY xxe SYSTEM 'file:///etc/passwd'> is processed, the parser resolves the reference and includes the content in the parsed result. This can leak local file contents or cause the server to issue outbound HTTP/SMB requests, enabling SSRF. Affected CPE: cpe:2.3:a:apache:lucene.net.analysis.common:4.8.0-beta00005 through 4.8.0-beta00017.

RemediationAI

Upgrade Lucene.Net.Analysis.Common to version 4.8.0-beta00018, which is the vendor-confirmed patched release. Update via NuGet: 'dotnet add package Lucene.Net.Analysis.Common --version 4.8.0-beta00018'. If an immediate upgrade is not feasible, compensating controls include: (1) validating and sanitizing any XML input before passing it to PatternParser, explicitly stripping or rejecting DOCTYPE declarations and ENTITY definitions - note this is error-prone and should not replace patching; (2) configuring the .NET XmlReader with XmlResolver set to null and DtdProcessing set to Prohibit wherever XML is parsed, if the application has direct control over parser instantiation; (3) restricting outbound network access from the application server to limit SSRF blast radius, though this does not address local file read via file:// URIs. Refer to the oss-security advisory at https://seclists.org/oss-sec/2026/q3/15 for further context.