VulnerabilityPublished 1 Nov 2024Updated 30 Oct 2026

org.apache.lucene.util.ArrayUtil.growExact · Security Exception

Affects luceneSource GCVE Database

Severity

Medium

Rated by Threat Radar

Data as of 30 Oct 2026, 17:03 UTC

What to do

Affected software

Product	Affected	Fixed in
OSS-Fuzzlucene`pkg:generic/lucene`Other threats	Affected releases/lucene/10.0.0 – releases/lucene/10.6.0 >=5d203f8337cb6a2350c1abe5d83e3e103d060645 13 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=376504918 ``` Crash type: Security exception Crash state: org.apache.lucene.util.ArrayUtil.growExact org.apache.lucene.util.ArrayUtil.grow org.apache.lucene.util.BytesRefBuilder.grow ```

Impact

The impact is limited to a security exception crash in the affected method, which could potentially cause denial of service or application instability if triggered. There is no evidence of code execution, data leakage, or other severe impacts. No known exploits are reported in the wild.

Summary

OSS-Fuzz detected a security exception crash in Apache Lucene's ArrayUtil.growExact method, which is involved in resizing arrays. The crash stack trace includes calls to ArrayUtil.grow and BytesRefBuilder.grow, indicating the issue arises during dynamic array growth operations. No further technical details, such as root cause or exploitability, are available from the provided data.

References

bugs.chromium.org/p/oss-fuzz/issues/detail?id=376504918 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 15:04 UTC

Technical details

References

Community reviews

Related threats