XML Resource Consumption Vulnerability in Apache Solr

CVE-2019-12401

Summary

Apache Solr, in versions 1.3.0 through 4.10.4, is susceptible to an XML resource consumption vulnerability known as an XML bomb, also referred to as a Lol Bomb. This vulnerability exploits XML DOCTYPE and ENTITY type elements, enabling an attacker to create an XML pattern that exponentially expands when parsed by the server's update handler. The result is a significant performance degradation, potentially causing the server to experience out-of-memory (OOM) errors during operation.

References