Read the docs
TI-2024-29032 Aliases CVE-2024-43383GHSA-2qw8-ppr5-m96c

Apache Lucene.Net.Replicator: Remote Code Execution in Lucene.Net.Replicator

Priority MEDIUM 40CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

Deserialization of Untrusted Data vulnerability in Apache Lucene.Net.Replicator. This issue affects Apache Lucene.NET's Replicator library: from 4.8.0-beta00005 through 4.8.0-beta00016. An attacker that can intercept traffic between a replication client and server, or control the target replication node URL, can provide a specially-crafted JSON response that is deserialized as an attacker-provided exception type. This can result in remote code execution or other potential unauthorized access. Users are recommended to upgrade to version 4.8.0-beta00017, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0119 68th percentileScored 2026-11-07
Fix Fixed Lucene.Net.Replicator (NuGet): 4.8.0-beta00017

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Lucene.Net.Replicator4.8.0-beta00005 – 4.8.0-beta00016—No fix listedCNA
—Lucene.Net.Replicator (NuGet)4.8.0-beta00005 to before 4.8.0-beta000174.8.0-beta00017Patch availableGHSA-2qw8-ppr5-m96c
  • Apache Lucene.Net.Replicator VendorApache Affected 4.8.0-beta00005 – 4.8.0-beta00016 Fixed in — No fix listed CNA
  • Lucene.Net.Replicator (NuGet) Vendor— Affected 4.8.0-beta00005 to before 4.8.0-beta00017 Fixed in 4.8.0-beta00017 Patch available GHSA-2qw8-ppr5-m96c

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:apache:lucene.net:4.8.0:beta00005:*:*:*:*:*:*4.8.0 beta00005VulnerableApache
cpe:2.3:a:apache:lucene.net:4.8.0:beta00006:*:*:*:*:*:*4.8.0 beta00006VulnerableApache
cpe:2.3:a:apache:lucene.net:4.8.0:beta00007:*:*:*:*:*:*4.8.0 beta00007VulnerableApache
cpe:2.3:a:apache:lucene.net:4.8.0:beta00008:*:*:*:*:*:*4.8.0 beta00008VulnerableApache
cpe:2.3:a:apache:lucene.net:4.8.0:beta00009:*:*:*:*:*:*4.8.0 beta00009VulnerableApache
cpe:2.3:a:apache:lucene.net:4.8.0:beta00010:*:*:*:*:*:*4.8.0 beta00010VulnerableApache
cpe:2.3:a:apache:lucene.net:4.8.0:beta00011:*:*:*:*:*:*4.8.0 beta00011VulnerableApache
cpe:2.3:a:apache:lucene.net:4.8.0:beta00012:*:*:*:*:*:*4.8.0 beta00012VulnerableApache
cpe:2.3:a:apache:lucene.net:4.8.0:beta00013:*:*:*:*:*:*4.8.0 beta00013VulnerableApache
cpe:2.3:a:apache:lucene.net:4.8.0:beta00014:*:*:*:*:*:*4.8.0 beta00014VulnerableApache
  • cpe:2.3:a:apache:lucene.net:4.8.0:beta00005:*:*:*:*:*:* Versions 4.8.0 beta00005 Vulnerable ·Apache
  • cpe:2.3:a:apache:lucene.net:4.8.0:beta00006:*:*:*:*:*:* Versions 4.8.0 beta00006 Vulnerable ·Apache
  • cpe:2.3:a:apache:lucene.net:4.8.0:beta00007:*:*:*:*:*:* Versions 4.8.0 beta00007 Vulnerable ·Apache
  • cpe:2.3:a:apache:lucene.net:4.8.0:beta00008:*:*:*:*:*:* Versions 4.8.0 beta00008 Vulnerable ·Apache
  • cpe:2.3:a:apache:lucene.net:4.8.0:beta00009:*:*:*:*:*:* Versions 4.8.0 beta00009 Vulnerable ·Apache
  • cpe:2.3:a:apache:lucene.net:4.8.0:beta00010:*:*:*:*:*:* Versions 4.8.0 beta00010 Vulnerable ·Apache
  • cpe:2.3:a:apache:lucene.net:4.8.0:beta00011:*:*:*:*:*:* Versions 4.8.0 beta00011 Vulnerable ·Apache
  • cpe:2.3:a:apache:lucene.net:4.8.0:beta00012:*:*:*:*:*:* Versions 4.8.0 beta00012 Vulnerable ·Apache
  • cpe:2.3:a:apache:lucene.net:4.8.0:beta00013:*:*:*:*:*:* Versions 4.8.0 beta00013 Vulnerable ·Apache
  • cpe:2.3:a:apache:lucene.net:4.8.0:beta00014:*:*:*:*:*:* Versions 4.8.0 beta00014 Vulnerable ·Apache
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:lucene.net:4.8.0:beta00015:*:*:*:*:*:*4.8.0 beta00015VulnerableApache
cpe:2.3:a:apache:lucene.net:4.8.0:beta00016:*:*:*:*:*:*4.8.0 beta00016VulnerableApache
  • cpe:2.3:a:apache:lucene.net:4.8.0:beta00015:*:*:*:*:*:* Versions 4.8.0 beta00015 Vulnerable ·Apache
  • cpe:2.3:a:apache:lucene.net:4.8.0:beta00016:*:*:*:*:*:* Versions 4.8.0 beta00016 Vulnerable ·Apache

Remediation

  • Fix · GHSA-2qw8-ppr5-m96c Lucene.Net.Replicator (NuGet) Fixed in 4.8.0-beta00017 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-43383
  2. 2026-10-03 Alias added: GHSA-2qw8-ppr5-m96c

References

Advisory 2

Other 3

  • TI-2026-35345 Apache Lucene.Net: Arbitrary file write from malicious server to Lucene.Net.Replicator client CVSS 4.0HIGH 8.9
  • TI-2026-35344 Apache Lucene.Net: Unauthenticated arbitrary file read on the Lucene.Net.Replicator replication server CVSS 4.0HIGH 8.9
  • TI-2026-35346 Apache Lucene.Net: XXE vulnerability in Lucene.Net.Analysis.Common PatternParser CVSS 4.0MEDIUM 4.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences