CVE-2019-12401

HIGH

Apache Solr 1.3.0-1.4.1, 3.1.0-3.6.2, 4.0.0-4.10.4 - XML Entity Expansion via Update Handler

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-12401. PoCs published by mbadanoiu.

AI-analyzed exploit summary The repository lacks actual exploit code and instead points to an external PDF for details, which is a common tactic for suspicious repos. The README provides minimal technical information about the XML bomb vulnerability in Apache Solr.

Description

Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack (a.k.a. Lol Bomb) via it’s update handler.?By leveraging XML DOCTYPE and ENTITY type elements, the attacker can create a pattern that will expand when the server parses the XML causing OOMs.

Exploits (1)

nomisec SUSPICIOUS
by mbadanoiu · poc
https://github.com/mbadanoiu/CVE-2019-12401

The repository lacks actual exploit code and instead points to an external PDF for details, which is a common tactic for suspicious repos. The README provides minimal technical information about the XML bomb vulnerability in Apache Solr.

Classification
Suspicious 90%
Attack Type
Dos
Complexity
Moderate
Reliability
Theoretical
Target: Apache Solr < 5.0.0
No auth needed
Prerequisites: Network access to vulnerable Solr instance
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (11)

Core 11
Core References
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2019/09/10/1
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20190926-0002/

Scores

CVSS v3 7.5
EPSS 0.3277
EPSS Percentile 97.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-776
Status published
Products (2)
apache/solr 1.3.0 - 1.4.1
org.apache.solr/solr-core 0 - 5.0.0Maven
Published Sep 10, 2019
Tracked Since Feb 18, 2026