Out-of-memory in IndexSearchFuzzer - Lucene
Summary
OSV-2023-971: Out-of-memory in IndexSearchFuzzer. Affects lucene versions >= c4694c31fde068119445ba6ed5587cfbf2170218, < 2474940bffe6118ed31ceb717fd49705d819e1fc. Fixed in 2474940bffe6118ed31ceb717fd49705d819e1fc. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Lucene is an open-source search library written in Java. It provides indexing and searching capabilities for various applications. Lucene is widely used in many software projects to enable efficient and accurate search functionality.
Vulnerability Detail
The vulnerability identified in Lucene is an out-of-memory issue in the IndexSearchFuzzer component. This vulnerability can be triggered when the fuzzer exhausts the available memory resources, leading to a crash. The specific crash state occurs within the IndexSearchFuzzer module. The impact of this vulnerability can result in denial of service (DoS) as the application becomes unresponsive or crashes due to memory exhaustion.
How To Fix
Minimum fixed version
2474940bffe6118ed31ceb717fd49705d819e1fc
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround available for this vulnerability. It is essential to update the Lucene package to a fixed version to mitigate the risk of exploitation.
Conclusion
The out-of-memory vulnerability in Lucene's IndexSearchFuzzer component can lead to a denial of service (DoS) situation. To mitigate this risk, it is crucial to update the Lucene package to a version that includes the fix. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for lucene →
FAQ
Lucene is an open-source search library written in Java that provides indexing and searching capabilities for various applications.
The vulnerability can lead to a denial of service (DoS) as the application becomes unresponsive or crashes due to memory exhaustion.
To fix this vulnerability, update the Lucene package to a version that includes the fix (commit 2474940bffe6118ed31ceb717fd49705d819e1fc or later).
No, there is no known workaround for this vulnerability. Updating to a fixed version is necessary.
You can find more information about this vulnerability in the OSS-Fuzz report: [link to the report].
References
Related vulnerabilities
Recent vulnerabilities recorded for lucene.
