CVE-2026-61483
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
Apache Lucy (retired project) has an uncontrolled recursion vulnerability in all versions. The project is no longer supported, so no fix will be released. Users are advised to find an alternative or restrict access to trusted users.
Risk Assessment
The vulnerability may lead to application crashes or resource exhaustion, but only affects unsupported software, increasing the risk of no patch.
Recommendation
Discontinue use of Apache Lucy and migrate to an actively supported solution, or restrict access to trusted users.
Other vulnerabilities in Apache Lucy
See all- CVE-2026-61486Critical
Stack-based buffer overflow vulnerability in Apache Lucy affects all versions. The project is retired and no fix will be released. Users are advised to find an alternative or restrict access to trusted users.
- CVE-2026-61484Critical
Deserialization of untrusted data vulnerability in Apache Lucy. The project is retired and no fix is planned. Users are advised to find an alternative or restrict access to trusted users.
- CVE-2026-61485High
A Memory Allocation with Excessive Size Value vulnerability in Apache Lucy affects all versions. As the project is retired, no fix will be released.
Original NVD description (English source)
** UNSUPPORTED WHEN ASSIGNED ** Uncontrolled Recursion vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.