CVE-2026-61484
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
Apache Lucy (all versions) contains a deserialization of untrusted data vulnerability. The project is retired, and the offending feature has been removed in version 0.8.0 outside the ASF.
Risk Assessment
The vulnerability could allow remote code execution or other attacks, but it only affects unsupported versions, so risk is limited to environments still using these versions.
Recommendation
It is recommended to find an alternative or restrict access to the instance to trusted users. If possible, update to version 0.8.0 from the LucySearch repository.
Other vulnerabilities in Apache Lucy
See all- CVE-2026-61486Critical
Apache Lucy (all versions) contains a stack-based buffer overflow vulnerability. The project is retired, and a fix has been released in version 0.8.0 in the repository outside the ASF.
- CVE-2026-61483High
Apache Lucy (all versions) contains an uncontrolled recursion vulnerability. The project is retired and no fix is planned. Users are recommended to find an alternative or restrict access to trusted users.
Original NVD description (English source)
** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. Lucy is now maintained outside of the ASF at https://github.com/lucysearch . 0.8.0 is no longer affected by this issue, because the offending feature has been removed there. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.