Security Exception in Apache Lucene: ArrayUtil.copyOfSubArray Vulnerability
Summary
OSV-2026-896: Security exception in org.apache.lucene.util.ArrayUtil.copyOfSubArray. Affects lucene versions >= 5d203f8337cb6a2350c1abe5d83e3e103d060645. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Lucene is a high-performance, full-featured text search engine library written in Java. It is widely used for implementing search functionality in applications, providing capabilities such as indexing and searching text. The library is known for its efficiency and scalability, making it a popular choice among developers. However, like any software, it is susceptible to vulnerabilities that can compromise its integrity and security.
Vulnerability Detail
The vulnerability arises from a security exception in the method org.apache.lucene.util.ArrayUtil.copyOfSubArray. This issue was reported through OSS-Fuzz, indicating that it can lead to crashes or unexpected behavior when handling certain data inputs. The crash state involves a chain of method calls that can potentially expose the application to security risks, particularly if the vulnerability is exploited by malicious actors. The severity of this vulnerability is classified as low, but it is crucial to address it to maintain the security and stability of applications relying on Lucene.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can implement input validation to ensure that data passed to the ArrayUtil.copyOfSubArray method adheres to expected formats and constraints. This can help mitigate the risk of triggering the vulnerability until a proper fix is applied.
Conclusion
The security exception in Apache Lucene's ArrayUtil.copyOfSubArray is a low-severity vulnerability that can lead to application crashes. It is essential for developers using Lucene to update to the latest version to mitigate this risk. Implementing input validation can serve as a temporary workaround while a proper fix is applied.
See every vulnerability recorded for lucene →
FAQ
The vulnerability is a security exception in the ArrayUtil.copyOfSubArray method, which can lead to application crashes.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Yes, updating to the latest version of Apache Lucene will address this vulnerability.
Failure to address this vulnerability may lead to application instability and potential security risks if exploited.
Detailed information can be found in the OSS-Fuzz report linked in the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for lucene.
