VulnerabilityPublished 3 Apr 2025Updated 12 Aug 2026

org.apache.lucene.analysis.ckb.SoraniNormalizer.normalize · Security Exception

Affects luceneSource GCVE Database

Severity

Medium

Rated by Threat Radar

Data as of 12 Aug 2026, 16:10 UTC

What to do

Affected software

Product	Affected	Fixed in
OSS-Fuzzlucene`pkg:generic/lucene`Other threats	Affected releases/lucene/10.0.0 – releases/lucene/10.5.1 >=5d203f8337cb6a2350c1abe5d83e3e103d060645 11 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Users should monitor the Apache Lucene project and OSS-Fuzz reports for updates and apply any forthcoming patches promptly.

Description

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=407477665 ``` Crash type: Security exception Crash state: org.apache.lucene.analysis.ckb.SoraniNormalizer.normalize org.apache.lucene.analysis.ckb.SoraniNormalizationFilter.incrementToken org.apache.lucene.analysis.miscellaneous.WordDelimiterGraphFilter.incrementToken ```

Impact

The impact is limited to a security exception crash within the Sorani language normalization process in Apache Lucene. There is no evidence of active exploitation or further consequences such as data corruption or remote code execution. The crash may affect applications using this specific analyzer component, potentially causing denial of service or processing interruptions.

Summary

The vulnerability involves a security exception crash in the org.apache.lucene.analysis.ckb.SoraniNormalizer.normalize method, which is part of the SoraniNormalizationFilter in Apache Lucene. This crash was identified by OSS-Fuzz and occurs during token processing in the Sorani language analyzer. The issue leads to a security exception but no further technical details, such as root cause or exploitability, are provided in the available data.

References

bugs.chromium.org/p/oss-fuzz/issues/detail?id=407477665 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 15:18 UTC

Technical details

References

Community reviews

Related threats