CVE-2019-12401

HIGH 7.5EPSS 7.4%

Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack (a.k.a. Lol Bomb) via it’s update handler.?By leveraging XML DOCTYPE and ENTITY type elements, the attacker can create a pattern that will expand when the server parses the XML causing OOMs.

CVSS v3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v2.0: 5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
EPSS: 7.44% chance of exploitation in the next 30 days, 94th percentile
Published: 2019-09-10
Updated: 2024-08-04

Proof-of-concept exploits (2)

DrunkenShells/Disclosures/tree/master/CVE-2019-12401-XML%20Bomb-Apache%20Solr
mbadanoiu/CVE-2019-124010★ · 2025-04-07

References

CVE Record
NVD entry

CVE-2019-12401

Proof-of-concept exploits (2)

References

Related