Opensolr is not vulnerable to CVE-2021-44228. The entire platform was patched on December 11, 2021, across every Solr version we host.
01 · What the vulnerability is
CVE-2021-44228 is a critical flaw disclosed in December 2021 in the log4j logging library. If a vulnerable application logs text that a user controls, an attacker can craft that text so it is executed as code on the server. It was not a Solr flaw: log4j is used by a large part of the Java ecosystem, and Solr is one of many applications that log through it.
02 · Is Opensolr affected
Old Solr versions are covered too
The fix is in log4j, not in Solr, so it protects an index on Solr 4 exactly as it protects one on Solr 9.
Nothing was required from you
Managed environments were patched by us. There was no customer action and no downtime window to book.
Need a different Solr version
You can create a new index on a newer Solr version from your control panel at any time. Migrations of an existing index can be done by our team as paid work.
03 · Your own Java applications
If you run Java services of your own, inside or outside Opensolr, patch or update log4j there as well. The Apache log4j security page lists the affected versions and the mitigation steps.
Apply vendor patches promptly
The window between a disclosure and mass scanning is now hours, not weeks.
Watch the official channels
Solr and log4j both publish security advisories. They are the first place a real fix appears.
Ask us about your indexes
If a security review asks you what Opensolr did about a specific CVE, write to us and we will answer in writing. Our posture is documented in the Trust Center.