CVE-2026-49844 Applicability – SonarQube Community Build

SonarQube Server / Community Build
, ,
1

Which versions are you using?

  • SonarQube Server / Community Build: 25.12.0.117093
  • SonarScanner: SonarScanner CLI 8.0.1.6346
  • Operating System: Windows Server
  • Java: Java 21

Our vulnerability scanner has detected CVE-2026-49844 – Apache Log4j Improper JSON Serialization in the following components bundled with SonarQube:

<SONARQUBE_HOME>\elasticsearch\lib\elasticsearch-log4j-8.16.6.jar
<SONARQUBE_HOME>\elasticsearch\lib\log4j-api-2.19.0.jar
<SONARQUBE_HOME>\elasticsearch\lib\log4j2-ecs-layout-1.2.0.jar
<SONARQUBE_HOME>\elasticsearch\modules\x-pack-core\log4j-1.2-api-2.19.0.jar

How is SonarQube deployed?

SonarQube Community Build is deployed on a Windows Server using the ZIP distribution.

Elasticsearch is the instance bundled with SonarQube; we have not installed or configured a separate Elasticsearch instance.

What are you trying to achieve?

We would like to confirm whether CVE-2026-49844 is actually applicable/exploitable in SonarQube Community Build 25.12.0.117093.

Our vulnerability scanner is reporting the vulnerability because log4j-api-2.19.0.jar is present within the bundled Elasticsearch libraries.

We understand that the presence of an affected library version does not necessarily mean that the vulnerable code path is reachable.

Could SonarSource please confirm:

  1. Is SonarQube Community Build 25.12.0.117093 affected by CVE-2026-49844?
  2. Does SonarQube or its bundled Elasticsearch use the affected Log4j JSON serialization functionality in a way that makes this vulnerability exploitable?
  3. If SonarQube is not affected, is there an official reference/confirmation that we can provide to our vulnerability-management team?
  4. If it is affected, which SonarQube Community Build version contains the fix?

Regards,

Samy

3

Hi,

I’ve unlisted your topic since you’re reporting a vulnerability.

For SonarQube Community Build, we’ve packaged a comprehensive vulnerability listing in the .csv file in the security directory of your SonarQube Community Build distribution. If the vulnerability you’ve found is not reflected there, or if you still have questions after consulting the file, please email security@sonarsource.com rather than making public posts, per our responsible disclosure policy.