HeroDevs
Visit NES for Apache Solr & Lucene Home Page

NES for Apache Solr 8.11.x Release Notes

3 versions

Comprehensive release notes and changelog for NES for Apache Solr 8.11.x, including security patches, bug fixes, and feature updates across all supported versions.

Feb 3, 2026
Latest: 8.11.6
4 Patched Vulnerabilities
VEX Statements

February 2026

8.11.6

Released Feb 3, 2026
CVE-2026-22444
CVE-2026-22022
Full Version: 
8.11.4-solr-8.11.6

Security Fixes

This release patches the following:

  • CVE-2026-22444: Insufficient file-access checking in standalone core-creation requests
    • Applied security patches to SchemaHandler, SolrConfigHandler, and other admin handlers
    • Enhanced permission validation and HTTP method checking
    • Fixed path and permission related NPEs
    • Added comprehensive security tests
  • CVE-2026-22022: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin
    • Fixed access control issues in admin handlers
  • Full Version: 8.11.4-solr-8.11.6

March 2025

8.11.5

Released Mar 25, 2025
CVE-2024-52012
CVE-2025-24814
Full Version: 
8.11.4-solr-8.11.5

Security Fixes

This release patches the following:

  • CVE-2024-52012: Relative Path Traversal vulnerability.
    • Assessed OSS 8.11.4 for impact and found not applicable.
  • CVE-2025-24814: Execution with Unnecessary Privileges.
    • <lib> usage disabled in solrconfig.xml by default
    • solr.config.lib.enabled can be used to enable/disable <lib> usage
  • Full Version: 8.11.4-solr-8.11.5

8.11.5-trial

Released Mar 25, 2025
Full Version: 
8.11.4-solr-8.11.5-trial

Notes

  • This release originates from the open‑source Apache Lucene and Solr project forked by HeroDevs.
  • This release contains no functional changes from Lucene and Solr version 8.11.4.
  • Full Version: 8.11.4-solr-8.11.5-trial

Stay in the loop

~/herodevs-spring-framework-support

Open Source Support

When official support ends, we're just getting started.