Security exception in org.apache.lucene.analysis.ckb.SoraniNormalizer.normalize
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=407477665 ``` Crash type: Security exception Crash state: org.apache.lucene.analysis.ckb.SoraniNormalizer.normalize org.apache.lucene.analysis.ckb.SoraniNormalizationFilter.incrementToken org.apache.lucene.analysis.miscellaneous.WordDelimiterGraphFilter.incrementToken ```
OSV-2025-253
Primary source · Revision 1 · Withdrawn
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:OSV-2025-253
lucene
Source reference: /affected/0/package/name
- Affected versions
- releases/lucene/10.0.0
Source reference:
/affected/0/versionsreleases/lucene/10.1.0Source reference:
/affected/0/versionsreleases/lucene/10.2.0Source reference:
/affected/0/versionsreleases/lucene/10.2.1Source reference:
/affected/0/versionsreleases/lucene/10.2.2Source reference:
/affected/0/versionsreleases/lucene/10.3.0Source reference:
/affected/0/versionsreleases/lucene/10.3.1Source reference:
/affected/0/versionsreleases/lucene/10.3.2Source reference:
/affected/0/versionsreleases/lucene/10.4.0Source reference:
/affected/0/versionsreleases/lucene/10.5.0Source reference:
/affected/0/versionsreleases/lucene/10.5.1Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"repo": "https://github.com/apache/lucene.git",
"type": "GIT",
"events": [
{
"introduced": "5d203f8337cb6a2350c1abe5d83e3e103d060645"
}
]
}
],
"package": {
"name": "lucene",
"purl": "pkg:generic/lucene",
"ecosystem": "OSS-Fuzz"
},
"versions": [
"releases/lucene/10.0.0",
"releases/lucene/10.1.0",
"releases/lucene/10.2.0",
"releases/lucene/10.2.1",
"releases/lucene/10.2.2",
"releases/lucene/10.3.0",
"releases/lucene/10.3.1",
"releases/lucene/10.3.2",
"releases/lucene/10.4.0",
"releases/lucene/10.5.0",
"releases/lucene/10.5.1"
],
"database_specific": {
"source": "https://github.com/google/oss-fuzz-vulns/blob/main/vulns/lucene/OSV-2025-253.yaml",
"introduced_range": "223e28ef16acb35cb43c89493855366d171de4f9:8af305892d726c180f03316c73aebf8183c2e481"
},
"ecosystem_specific": {
"severity": "LOW"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #37691 · Revision 1
- Added to Heist Feed
- Publisher date