The Apache project patched three Apache Lucene.NET vulnerability issues in the 4.8.0-beta00018 release. Two of the flaws carry a high CVSS score of 8.9. Both live inside the Lucene.Net.Replicator library. Why This Apache Lucene.NET Vulnerability Set Matters Lucene.Net gives many .NET applications their full-text search features. As a result, one library flaw can reach a wide install base. Two of these bugs also need no authentication, so the risk climbs fast.