# Vulnerable Apache Lucene in ElasticSearch 7.17.28

**URL:** <https://discuss.elastic.co/t/vulnerable-apache-lucene-in-elasticsearch-7-17-28/375655>\
**Category:** Elasticsearch\
**Created:** [March 10, 2025, 1:46pm UTC](https://discuss.elastic.co/t/vulnerable-apache-lucene-in-elasticsearch-7-17-28/375655 "2025-03-10T13:46:34Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![treektPL](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/treektpl/32/141912_2.png) [@treektPL](https://discuss.elastic.co/u/treektPL)\
**Post date:** [March 10, 2025, 1:46pm UTC](https://discuss.elastic.co/t/vulnerable-apache-lucene-in-elasticsearch-7-17-28/375655/1 "2025-03-10T13:46:34Z")

</div>

Hi,  
I see that the latest update of Elasticsearch 7.17.28 have still vulnerability CVE-2024-45772 which affects Apache Lucene from 4.4.0 before 9.12.0. That mean's ES should update Lucene to 9.12.0 at least.  
Do we know about any mitigation plan?  
As I can see Apache Lucene 8 is not supported anymore.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [March 10, 2025, 1:55pm UTC](https://discuss.elastic.co/t/vulnerable-apache-lucene-in-elasticsearch-7-17-28/375655/2 "2025-03-10T13:55:23Z")

</div>

Upgrade to Elasticsearch 8.17, which [uses Lucene 9.12](https://artifacts.elastic.co/reports/dependencies/dependencies-8.17.0.html#elasticsearch-8.17.0).

---

<div class="post-metadata">

**Author:** ![treektPL](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/treektpl/32/141912_2.png) [@treektPL](https://discuss.elastic.co/u/treektPL)\
**Post date:** [March 10, 2025, 2:00pm UTC](https://discuss.elastic.co/t/vulnerable-apache-lucene-in-elasticsearch-7-17-28/375655/3 "2025-03-10T14:00:29Z")

</div>

I'd love to but due to some other limitations we cannot do this at this point.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [March 10, 2025, 2:02pm UTC](https://discuss.elastic.co/t/vulnerable-apache-lucene-in-elasticsearch-7-17-28/375655/4 "2025-03-10T14:02:51Z")

</div>

Elasticsearch major versions are typically aligned with major Lucene versions, so I do not think Elasticsearch 7.17.28 will/can be upgraded in this respect.

Why are you not able to upgrade to Elasticsearch 8.17?

---

<div class="post-metadata">

**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\
**Post date:** [March 10, 2025, 2:10pm UTC](https://discuss.elastic.co/t/vulnerable-apache-lucene-in-elasticsearch-7-17-28/375655/5 "2025-03-10T14:10:57Z")

</div>

Unfortunately we can't engage in conversations about security vulnerabilities in public. Please use the process described at [this page](https://www.elastic.co/community/security) instead.