Apache Lucene.net vulnerabilities

4 CVEs affecting Apache Lucene.net, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-47896, published 2026-07-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-43383, published 2024-10-31. High severity, CVSS 8.1. EPSS: 1.2% chance of exploitation in the next 30 days. Deserialization of Untrusted Data vulnerability in Apache Lucene.Net.Replicator. This issue affects Apache Lucene.NET's Replicator library: from 4.8.0-beta00005 through 4.8.0-beta00016. An attacker…
CVE-2026-47896, published 2026-07-03. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene.Net (Lucene.Net.Replicator library). This issue affects Apache Lucene.Net.Replicator:…
CVE-2026-47897, published 2026-07-03. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene.Net (Lucene.Net.Replicator library). This issue affects Apache Lucene.Net.Replicator:…
CVE-2026-47898, published 2026-07-03. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Improper Restriction of XML External Entity Reference vulnerability in Apache Lucene.Net (Lucene.Net.Analysis.Common library). This issue affects Apache Lucene.Net.Analysis.Common: from…