CVE-2026-47898 is an XML external entity flaw in Apache Lucene.Net.Analysis.Common, scored CVSS 9.8 (critical). Apache fixed it in 4.8.0-beta00018 and recommends upgrading from any version between 4.8.0-beta00005 and the fix. Check your NuGet dependencies, including transitive ones, and update.
What's affected
The NVD record, taken from Apache's announcement, says the issue affects Apache Lucene.Net.Analysis.Common from 4.8.0-beta00005 before 4.8.0-beta00018. Users are recommended to upgrade to 4.8.0-beta00018, which fixes it.
The record says nothing more about which classes read XML or how. The Apache mailing list page rendered no text when I fetched it, so I rely on the record for the wording. If you use Lucene.Net analyzers, read the Apache announcement and the project's release notes for specifics.
The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
How to check if you're exposed
List the Lucene.Net packages in each solution, including transitive references.
dotnet list package --include-transitive | grep -i lucene
Look for Lucene.Net.Analysis.Common at a version from 4.8.0-beta00005 up to but not including 4.8.0-beta00018.
Also check lock files and deployed output. Applications that ship their own copies of the DLL, or that reference the package through another library such as a search wrapper, can carry an old version even when your own project file looks fine. Searching a deployment for Lucene.Net.Analysis.Common.dll and checking its file version catches that.
A dependency scan of your solution files and lockfiles gives a quick inventory.
What to do now
- Run the package listing for every .NET solution that might use Lucene.Net.
- Update Lucene.Net.Analysis.Common to 4.8.0-beta00018 or later, and keep the other Lucene.Net packages on matching versions.
- Rebuild and redeploy, including services that bundle the DLL.
- Check wrapper libraries that pin Lucene.Net and update them.
- Where you parse XML in your own code near this library, confirm external entity resolution is disabled.
Why it matters
The weakness is CWE-611, improper restriction of XML external entity reference. XML allows documents to refer to outside resources. A parser that follows those references on untrusted input can be made to read local files or contact other systems. Safe parsers turn the feature off.
The score of 9.8 reflects network reach with no privileges and no user action. The record does not say which input paths reach the vulnerable code, so judge exposure by where your application feeds XML to the library. The record's KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2026-47898 exploited in the wild?
The record's KEV flag is false, and the pages I read do not say it is exploited. Treat it as a patch item and keep an eye on the advisory for changes.
Is this a beta only issue?
The affected range uses beta version numbers because Lucene.Net 4.8.0 has been released as a series of beta builds. Upgrade to 4.8.0-beta00018 or later.
Sources
Last reviewed: 19 October 2026.
