Security Exception in Apache Lucene: ConcatenateGraphFilter Vulnerability
Summary
OSV-2026-153: Security exception in org.apache.lucene.analysis.miscellaneous.ConcatenateGraphFilter$BytesRefBuilderT. Affects lucene versions >= 5d203f8337cb6a2350c1abe5d83e3e103d060645. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Lucene is a high-performance, full-featured text search engine library written in Java. It is widely used for indexing and searching text in various applications. The library provides powerful search capabilities and is known for its scalability and efficiency. However, it is susceptible to certain vulnerabilities, including the recent security exception found in the ConcatenateGraphFilter component, which could compromise the integrity of applications relying on this library.
Vulnerability Detail
The vulnerability is a security exception that occurs in the org.apache.lucene.analysis.miscellaneous.ConcatenateGraphFilter$BytesRefBuilderT class. This issue was reported by OSS-Fuzz and can lead to crashes in applications using this component. The crash state indicates that the vulnerability can be triggered during the cloning of an AttributeSource$State, potentially allowing an attacker to exploit the flaw and disrupt the functionality of the application. The severity of this vulnerability is classified as low, but it still poses a risk to the stability of systems utilizing Lucene.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the ConcatenateGraphFilter component until a patch is applied. This may involve modifying the indexing or searching logic in the application to bypass this specific filter.
Conclusion
The security exception in the ConcatenateGraphFilter of Apache Lucene poses a low-severity risk that can lead to application crashes. Users are advised to update to the latest version of the library to mitigate this vulnerability. Temporary workarounds are available, but the best course of action is to apply the patch as soon as possible.
See every vulnerability recorded for lucene →
FAQ
The impact includes potential crashes in applications using the affected component, which can disrupt service and affect user experience.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without requiring any installation.
Yes, a patched version of Apache Lucene is available. Users should update to the latest version to mitigate the vulnerability.
If an immediate update is not possible, consider implementing the suggested workaround by avoiding the use of the ConcatenateGraphFilter component.
Detailed information can be found in the OSS-Fuzz report and the Apache Lucene documentation regarding the specific component.
References
Related vulnerabilities
Recent vulnerabilities recorded for lucene.
