CVE-2024-45772
Apache Lucene Replicator: Security Vulnerability in Lucene Replicator - Deserialization Issue
Deserialization of Untrusted Data vulnerability in Apache Lucene Replicator.
This issue affects Apache Lucene's replicator module: from 4.4.0 before 9.12.0. The deprecated org.apache.lucene.replicator.http package is affected. The org.apache.lucene.replicator.nrt package is not affected.
Users are recommended to upgrade to version 9.12.0, which fixes the issue.
The deserialization can only be triggered if users actively deploy an network-accessible implementation and a corresponding client using a HTTP library that uses the API (e.g., a custom servlet and HTTPClient). Java serialization filters (such as -Djdk.serialFilter='!*' on the commandline) can mitigate the issue on vulnerable versions without impacting functionality.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Apache Lucene Replicator: Security Vulnerability in Lucene Replicator - Deserialization Issue
Deserialization of Untrusted Data vulnerability in Apache Lucene Replicator.
This issue affects Apache Lucene's replicator module: from 4.4.0 before 9.12.0. The deprecated org.apache.lucene.replicator.http package is affected. The org.apache.lucene.replicator.nrt package is not affected.
Users are recommended to upgrade to version 9.12.0, which fixes the issue.
The deserialization can only be triggered if users actively deploy an network-accessible implementation and a corresponding client using a HTTP library that uses the API (e.g., a custom servlet and HTTPClient). Java serialization filters (such as -Djdk.serialFilter='!*' on the commandline) can mitigate the issue on vulnerable versions without impacting functionality.
- Record
CVE-2024-45772- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L - Weakness
- CWE-502
- Updated
- 2026-11-02
EUVDEUVD-2024-2793
Deserialization of Untrusted Data vulnerability in Apache Lucene Replicator.
This issue affects Apache Lucene's replicator module: from 4.4.0 before 9.12.0. The deprecated org.apache.lucene.replicator.http package is affected. The org.apache.lucene.replicator.nrt package is not affected.
Users are recommended to upgrade to version 9.12.0, which fixes the issue.
The deserialization can only be triggered if users actively deploy an network-accessible implementation and a corresponding client using a HTTP library that uses the API (e.g., a custom servlet and HTTPClient). Java serialization filters (such as -Djdk.serialFilter='!*' on the commandline) can mitigate the issue on vulnerable versions without impacting functionality.
- Record
EUVD-2024-2793- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g643-xq6w-r67c
Deserialization of Untrusted Data vulnerability in Apache Lucene Replicator.
This issue affects Apache Lucene's replicator module: from 4.4.0 before 9.12.0. The deprecated org.apache.lucene.replicator.http package is affected. The org.apache.lucene.replicator.nrt package is not affected.
Users are recommended to upgrade to version 9.12.0, which fixes the issue.
The deserialization can only be triggered if users actively deploy an network-accessible implementation and a corresponding client using a HTTP library that uses the API (e.g., a custom servlet and HTTPClient). Java serialization filters (such as -Djdk.serialFilter='!*' on the commandline) can mitigate the issue on vulnerable versions without impacting functionality.
- Record
GHSA-g643-xq6w-r67c- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L - Weakness
- CWE-502
- Updated
- 2026-11-02
NVD
Deserialization of Untrusted Data vulnerability in Apache Lucene Replicator.
This issue affects Apache Lucene's replicator module: from 4.4.0 before 9.12.0. The deprecated org.apache.lucene.replicator.http package is affected. The org.apache.lucene.replicator.nrt package is not affected.
Users are recommended to upgrade to version 9.12.0, which fixes the issue.
The deserialization can only be triggered if users actively deploy an network-accessible implementation and a corresponding client using a HTTP library that uses the API (e.g., a custom servlet and HTTPClient). Java serialization filters (such as -Djdk.serialFilter='!*' on the commandline) can mitigate the issue on vulnerable versions without impacting functionality.
- Record
CVE-2024-45772- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L - CVSS 3.1
- 8.0 High
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSVGHSA-g643-xq6w-r67c
Deserialization of Untrusted Data vulnerability in Apache Lucene Replicator.
This issue affects Apache Lucene's replicator module: from 4.4.0 before 9.12.0. The deprecated org.apache.lucene.replicator.http package is affected. The org.apache.lucene.replicator.nrt package is not affected.
Users are recommended to upgrade to version 9.12.0, which fixes the issue.
The deserialization can only be triggered if users actively deploy an network-accessible implementation and a corresponding client using a HTTP library that uses the API (e.g., a custom servlet and HTTPClient). Java serialization filters (such as -Djdk.serialFilter='!*' on the commandline) can mitigate the issue on vulnerable versions without impacting functionality.
- Record
GHSA-g643-xq6w-r67c- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L - Weakness
- CWE-502
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.lucene:lucene-replicatorMaven |
4.4.0 up to 9.12.0 | 9.12.0 |
org.apache.lucene:lucene-replicatorMaven |
4.4.0 up to 9.12.0, plus listed versions 4.10.04.10.14.10.24.10.34.10.4 Show 45 moreShow less4.5.04.5.14.6.04.6.14.7.04.7.14.7.24.8.04.8.14.9.04.9.15.0.05.1.05.2.05.2.15.3.05.3.15.3.25.4.05.4.15.5.05.5.15.5.25.5.35.5.45.5.56.0.06.0.16.1.06.2.06.2.16.3.06.4.06.4.16.4.26.5.06.5.16.6.06.6.16.6.26.6.36.6.46.6.56.6.67.0.0 |
9.12.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-45772 is a medium vulnerability (CVSS 5.1) in Apache Lucene Replicator, published September 30, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.58%, the 48th percentile. Fixed in org.apache.lucene:lucene-replicator 9.12.0.
References
Left out here: 57 versions. The JSON record has them.