# Lucene vulnerability in elastic search

**URL:** <https://discuss.elastic.co/t/lucene-vulnerability-in-elastic-search/370563>\
**Category:** Elasticsearch\
**Created:** [November 14, 2024, 2:48pm UTC](https://discuss.elastic.co/t/lucene-vulnerability-in-elastic-search/370563 "2024-11-14T14:48:06Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Monica\_Muraliprakash](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/monica_muraliprakash/32/138505_2.png) [@Monica\_Muraliprakash](https://discuss.elastic.co/u/Monica_Muraliprakash)\
**Post date:** [November 14, 2024, 2:48pm UTC](https://discuss.elastic.co/t/lucene-vulnerability-in-elastic-search/370563/1 "2024-11-14T14:48:06Z")

</div>

We are seeing that Vulnerable version of Apache Lucene[8.11.3] is consumed in Elasticsearch. It is related to the Apache Lucene replicator. Here it is recommended to upgrade to 9.12.0 of Lucene but the elasticsearch highest version (8.15.3) consists 9.11.1 version of Lucene. Wanted to understand what is the plan from ES side to fix this vulnerability?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [November 14, 2024, 2:52pm UTC](https://discuss.elastic.co/t/lucene-vulnerability-in-elastic-search/370563/2 "2024-11-14T14:52:10Z")

</div>

Hello and welcome,

You need to send an e-mail to `security@elastic.co`, Elastic does not comment on possible vulnerabilities on public forums.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [November 14, 2024, 3:07pm UTC](https://discuss.elastic.co/t/lucene-vulnerability-in-elastic-search/370563/3 "2024-11-14T15:07:06Z")

</div>

> [@Monica\_Muraliprakash](#):
>
> but the elasticsearch highest version (8.15.3) consists 9.11.1 version of Lucene

That is no longer the latest version of Elasticsearch. Elasticsearch 8.16 was recently released and seem to use Lucene 9.12 according to [the release note](https://www.elastic.co/guide/en/elasticsearch/reference/current/release-notes-8.16.0.html#upgrade-8.16.0). I would recommend you upgrade.