OSSEVA FOR APACHE SOLR
Apache Solr support after Solr 8 end of life: patched builds, no reindex
Apache Solr support from OSSeva covers the versions Apache no longer fixes. Solr 8 reached end of life on 25 October 2024 and Solr 7 on 11 May 2022, and OSSeva's CVE directory lists four advisories published against 8.x since. Send your work email and an engineer replies within 1 business day with coverage for your Solr version.
| Who it is for | Teams running Solr 6, 7 or 8, standalone or SolrCloud, who cannot reindex and re-validate relevance yet |
|---|---|
| What you get | Signed patched builds on your line, with the Lucene index format, schema and analysers unchanged. Assure adds an exposure audit, a reindex-aware upgrade plan and 24/7 reactive support. |
| How it is priced | Per cluster, not per node, core or document. Ask for a quote. |
| What happens next | You send your work email, we confirm your version and components, and you get a coverage plan. |
Reply within 1 business day · No commitment · or book a 15-minute call
Last reviewed
Trusted globally by enterprises
Solr end-of-life dates, checked 20 October 2026
Dates and final releases are from endoflife.date, which tracks the Solr project's own announcements.
| Line | End of life | Final or latest release | Status on 20 October 2026 |
|---|---|---|---|
| 6 | 13 Mar 2019 | 6.6.6 (1 Apr 2019) | End of life |
| 7 | 11 May 2022 | 7.7.3 (24 Apr 2020) | End of life |
| 8 | 25 Oct 2024 | 8.11.4 (24 Sep 2024) | End of life |
| 9 | Not set | 9.11.0 (4 Oct 2026) | Supported |
| 10 | Not set | 10.0.0 (3 Mar 2026) | Supported |
Solr 7's last release came more than two years before its end-of-life date. OSSeva patched builds cover Solr 6, 7 and 8.
Solr end-of-life chart, every version →Solr 8 end of life →Solr 7 end of life →
Advisories published since Solr 8 and Solr 7 ended
Entries in OSSeva's CVE directory published after each line's end-of-life date whose affected range includes its final release. Solr 7 never got the fixes for CVE-2024-45216 (CVSS 9.8, authentication) and CVE-2024-45217; they landed in 8.11.4.
Solr 8.11.4: 4 entries since 25 October 2024
| CVE | Published | CVSS | Affected range (NVD) | Fixed upstream in |
|---|---|---|---|---|
| CVE-2024-52012 | 2025-01-27 | 5.4 | 6.6 to 9.7.0 | 9.8.0 |
| CVE-2025-24814 | 2025-01-27 | 5.5 | All versions through 9.7 | 9.8.0 |
| CVE-2026-22022 | 2026-01-21 | 8.2 | 5.3.0 to 9.10.0 | 9.10.1 |
| CVE-2026-22444 | 2026-01-21 | 7.1 | 8.6 to 9.10.0 | 9.10.1 |
Solr 7.7.3: 6 entries since 11 May 2022
| CVE | Published | CVSS | Affected range (NVD) | Fixed upstream in |
|---|---|---|---|---|
| CVE-2023-50386 | 2024-02-09 | 8.8 | >=6.0.0 <8.11.3; >=9.0.0 <9.4.1 | See advisory |
| CVE-2024-45216 | 2024-10-16 | 9.8 | >=5.3.0 <8.11.4; >=9.0.0 <9.7.0 | See advisory |
| CVE-2024-45217 | 2024-10-16 | 8.1 | 6.6.0 before 8.11.4; 9.0.0 before 9.7.0 | 8.11.4; 9.7.0 |
| CVE-2024-52012 | 2025-01-27 | 5.4 | 6.6 to 9.7.0 | 9.8.0 |
| CVE-2025-24814 | 2025-01-27 | 5.5 | All versions through 9.7 | 9.8.0 |
| CVE-2026-22022 | 2026-01-21 | 8.2 | 5.3.0 to 9.10.0 | 9.10.1 |
The directory is OSSeva's curated list from NVD, not every advisory filed. Confirm any entry at nvd.nist.gov.
Why now
Solr 8 has been unpatched since 25 October 2024
Apache Solr 8 reached end of life on 25 October 2024, with 8.11.4 as its final release. Solr 7 ended on 11 May 2022. Solr 10, released 3 March 2026, is the current line, and Apache shipped 9.11.0 on 4 October 2026 as the last 9.x release. Nothing is backported below 9.
Solr is frequently the most exposed service in the estate
Solr has a long history of remote code execution advisories reached through the config API, the VelocityResponseWriter, the DataImportHandler and the streaming expression handlers. Many deployments were stood up behind an assumption of network isolation that no longer matches how the application calls them. Deserialization and SSRF classes hit this component hard.
Upgrading Solr means re-validating relevance, not just swapping a binary
Lucene index formats change between majors, analysers are deprecated, and query parser behaviour shifts in ways that move result ordering. A Solr upgrade is a reindex plus a relevance regression cycle plus sign-off from whoever owns search quality. Extended support is what buys the time to do that properly.
Versions covered
All versions below receive active CVE patches from OSSeva. Version numbers in monospace are exact release identifiers.
| Version | Status | Active CVEs |
|---|---|---|
| 6.x(Community EOL 13 Mar 2019 — OSSeva patched) | EOL | Clean |
| 7.x(Community EOL 11 May 2022 — OSSeva patched) | EOL | Clean |
| 8.x(Community EOL 25 Oct 2024 — OSSeva patched) | EOL | Clean |
| 9.x(9.11.0 is the last upstream 9.x release) | Extended | Clean |
| 10.x(Released 3 Mar 2026) | Current | Clean |
Running a Apache Solr version or build not listed here?
What you get
Three tiers — pick the level of engagement that matches your team's operational needs and compliance requirements.
OSSeva Patch
CVE patches for Solr 6, 7 and 8 with the index format unchanged.
- Security backports for 6.x, 7.x and 8.x — no reindex required
- Config API, VelocityResponseWriter and DIH advisory coverage
- Bundled Lucene, Jetty and Zookeeper client patching
- Docker / tarball / WAR delivery
- Signed artifacts (GPG)
- Relevance regression testing
- 24/7 managed operations
OSSeva Assure
Patch plus exposure audit and a reindex-aware upgrade plan.
- Everything in Patch
- Handler and request-path exposure audit
- SolrCloud and ZooKeeper ensemble security review
- Schema and analyser deprecation inventory for 9.x / 10.x
- SOC 2 / HIPAA attestation package
- Reindex strategy and relevance regression plan
- 24/7 reactive support
OSSeva Operate
Full MSP: 24/7 cluster monitoring, 15-min SLA, named search engineers.
- Everything in Assure
- 24/7 query latency, shard health and replica monitoring
- 15-minute P1 incident response SLA
- Named senior Solr / Lucene engineer
- Index optimisation and segment merge management
- Upgrade execution with parallel-index cutover
- Quarterly relevance and capacity reviews
All tiers priced per cluster/application — not per core.
How it installs
OSSeva artifacts arrive via your existing package infrastructure. Pull the patched version the same way you pull upstream today — just from the OSSeva registry.
# Version, JVM and uptime
curl -s 'http://solr:8983/solr/admin/info/system?wt=json' \
| jq '.lucene["solr-spec-version"], .jvm.version'
# Anything at 8.x or below receives no upstream security fixes.
# List enabled request handlers — the historical RCE paths live here
curl -s 'http://solr:8983/solr/mycore/config?wt=json' \
| jq '.config.requestHandler | keys'# Drop-in replacement, same index format, same schema
docker pull artifacts.osseva.io/solr:8.11.4-osseva-1
docker run -d --name solr \
-p 8983:8983 \
-v /var/solr:/var/solr \
artifacts.osseva.io/solr:8.11.4-osseva-1 \
solr-foregroundMigrate from Unsupported community Solr 7.x and 8.x
OSSeva ships patched Solr builds on the line you already run, so the Lucene index format, schema and analyser chain stay exactly as they are and no reindex is required to become secure. The upgrade to Solr 9 or 10 is then planned properly, with a parallel index and a relevance regression cycle rather than a rushed cutover.
Pricing model
OSSeva for Apache Solr is priced per cluster — not per node, core, shard or indexed document.
ZooKeeper 3.5 custom support for SolrCloud 8.x
Which Solr releases bundle ZooKeeper 3.5? Solr 8.2 through 8.6 ship ZooKeeper 3.5.5 or 3.5.7. Solr 8.7 and later 8.x releases moved to 3.6.2, and Solr 9 to 3.7.0 and newer.
ZooKeeper 3.5 reached end of life on 1 June 2022, and 3.5.10 was its last release, so the Apache project issues no more fixes for it. OSSeva's standard ZooKeeper coverage starts at 3.6. ZooKeeper 3.5 is offered as custom support, scoped per engagement.
Custom support covers CVE backports into 3.5.x builds made from the upstream source, and SBOM and VEX evidence for each build. A scanner finding or an auditor's question then gets a written answer for your configuration: fixed, not present, or not reachable.
SolrCloud keeps cluster state and configsets in ZooKeeper, and the ensemble is a separate install from Solr's own client jar, so it can be on 3.5 even where the Solr nodes are newer. We scope the ensemble and the Solr line together.
Send us the versions you run and we scope it with you. Contact us for a quote.
Releases that bundle ZooKeeper 3.5.x
| Release | Bundled ZooKeeper |
|---|---|
| Solr 8.2.0 to 8.5.2 | 3.5.5 |
| Solr 8.6.0 to 8.6.3 | 3.5.7 |
Source: lucene/ivy-versions.properties at each lucene-solr release tag (github.com/apache/lucene-solr), checked 15 October 2026.
Is Solr 8.11 still getting security fixes?
No. Solr 8.11.4 was the last release, and the Solr download page describes 9.11.0, released 4 October 2026, as the last 9.x release. CVE-2026-22444, disclosed in January 2026, affects Solr 8.6 through 9.10.0 and is fixed only in 9.10.1, so 8.11.4 stays exposed. OSSeva ships patched Solr 8.11 builds today with fixes like this backported.
When did Apache Solr 8 reach end of life?
Apache Solr 8 reached end of life on 25 October 2024. On that date the Lucene and Solr PMCs announced that, with Lucene 8 at end of life, no further Solr 8 releases would ship. Solr 8.11.4, released on 24 September 2024, is the final 8.x release. Solr 10.0.0, released on 3 March 2026, is the current major, and 9.11.0, released 4 October 2026, is the last 9.x release.
Can I patch Solr without reindexing?
Yes — that is the point of backporting onto your existing line. OSSeva builds keep the Lucene index format, schema handling and analyser behaviour of the release you are on, so patched binaries drop onto the same data directory. Reindexing only becomes necessary when you move to a new major version.
Why are Solr upgrades harder than most component upgrades?
Because search behaviour is part of the contract. Lucene index formats change between majors, analysers and query parsers are deprecated or altered, and result ordering can shift in ways that are invisible to a health check but obvious to users. A Solr major upgrade is a reindex plus a relevance regression cycle, which is why it is deferred far longer than a typical library bump.
Does OSSeva cover SolrCloud and the ZooKeeper ensemble behind it?
Yes to both. SolrCloud deployments coordinate through ZooKeeper, and that ensemble is usually older than the Solr cluster itself. OSSeva patches the Solr nodes and the ensemble under the same engagement — see the ZooKeeper coverage for how those ensembles are handled.
What about the Solr CVEs that come from bundled libraries?
They are included. A large share of Solr advisories arrive through bundled Lucene, Jetty, the ZooKeeper client and logging libraries rather than Solr's own code. OSSeva patches the shipped dependency set as part of the build.
Who provides Solr support besides the Apache Solr project?
Commercial vendors built around Solr, cloud providers with managed search services, and third-party support companies all offer Solr support, so ask each which versions it covers. OSSeva fits where Solr is one component of a larger stack: one contract across the stack, end-of-life Solr versions included, and support that runs wherever you run Solr. The SolrCloud ZooKeeper ensemble is covered under the same engagement.
Does OSSeva support current Solr versions or only end-of-life ones?
Both. The versions list covers Solr 6 to 10 with patches active on every line, including 9.x, whose last upstream release is 9.11.0, and the current 10.x. Patch ships backports for 6.x, 7.x and 8.x with no reindex required, and Assure adds the reindex strategy and relevance regression plan for the move to 9.x or 10.x. OSSeva Operate patches Critical CVEs (CVSS ≥ 9.0) within 48 hours and High within 7 days.
How is OSSeva Solr support priced?
OSSeva for Apache Solr is priced per cluster, not per node, core, shard or indexed document. Patch covers signed patched builds, Assure adds the exposure audit and reindex-aware upgrade plan with 24/7 reactive support, and Operate adds proactive 24/7 monitoring and end-to-end managed operations with a 15-minute P1 SLA. Book a discovery call for a quote.
Get a quote
Ready to get Apache Solr patched and supported?
Tell us your Apache Solr versions and an engineer replies within 1 business day with coverage and a price. Prefer a call? It takes 15 minutes.
Prefer to talk or read more first?