CVE-2026-61483
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
Apache Lucy (all versions) contains an uncontrolled recursion vulnerability. The project is retired and no fix is planned. Users are recommended to find an alternative or restrict access to trusted users.
Risk Assessment
The risk includes potential denial of service or system crash due to uncontrolled recursion, and since the project is unsupported, no patches are available.
Recommendation
Discontinue use of Apache Lucy and migrate to an alternative solution, or restrict access to trusted users only.
Other vulnerabilities in Apache Lucy
See all- CVE-2026-61486Critical
Apache Lucy (all versions) contains a stack-based buffer overflow vulnerability. The project is retired, and a fix has been released in version 0.8.0 in the repository outside the ASF.
- CVE-2026-61484Critical
Apache Lucy (all versions) contains a deserialization of untrusted data vulnerability. The project is retired, and the offending feature has been removed in version 0.8.0 outside the ASF.
Original NVD description (English source)
** UNSUPPORTED WHEN ASSIGNED ** Uncontrolled Recursion vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the ASF. Lucy is now maintained outside of the ASF at https://github.com/lucysearch
Vulnerability data from NVD (NIST) · CISA KEV · EPSS