CVE-2019-0192: Apache Solr Remote Code Execution
Summary
CVE-2019-0192: Critical severity vulnerability that affects org.apache.solr:solr-core. Affects org.apache.solr:solr-core across 2 version ranges.
>= 5.0.0, < 7.0.0
>= 6.0.0, < 7.0.0
Fixed in 7.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Solr is an open-source search platform built on Apache Lucene. It provides full-text search, hit highlighting, faceted search, distributed search, and more. The solr-core package is a core component of Apache Solr, responsible for handling indexing and querying functionality. Unfortunately, versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5 of solr-core are vulnerable to a critical remote code execution vulnerability.
Vulnerability Detail
The Config API in Apache Solr allows the configuration of the JMX server through an HTTP POST request. This vulnerability arises from the unsafe deserialization of data in Solr. An attacker can exploit this by pointing the Config API to a malicious RMI server, enabling them to execute arbitrary code on the Solr server. This can lead to a complete compromise of the affected Solr instance, potentially resulting in unauthorized access, data leakage, or further attacks on the underlying system.
How To Fix
Latest published version: 10.0.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advised to disable the Config API if it is not required for the Solr instance's functionality. This can be achieved by modifying the Solr configuration file and removing or commenting out the relevant configuration entries. By disabling the Config API, the attack surface for this vulnerability is reduced.
Conclusion
The CVE-2019-0192 vulnerability in Apache Solr's solr-core package allows for remote code execution, posing a significant risk to affected systems. To mitigate this vulnerability, it is crucial to upgrade to a fixed version of Apache Solr (7.0.0 or later) and keep the installation up to date with security patches. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.solr:solr-core →
FAQ
Apache Solr is an open-source search platform built on Apache Lucene. It provides advanced search capabilities and is widely used for powering search functionality in various applications.
Versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5 of Apache Solr's solr-core package are affected by this vulnerability.
By leveraging the Config API in Apache Solr, an attacker can configure the JMX server to connect to a malicious RMI server. This allows them to trigger unsafe deserialization and execute arbitrary code on the Solr server.
Exploiting this vulnerability can lead to remote code execution on the Solr server. This can result in unauthorized access, data leakage, or further attacks on the underlying system.
Yes, upgrading to Apache Solr version 7.0.0 or later will fix this vulnerability. It is recommended to keep the Solr installation up to date with the latest security patches.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.solr:solr-core.
