CVE-2026-61484
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Deserialization of untrusted data vulnerability in Apache Lucy. The project is retired and no fix is planned. Users are advised to find an alternative or restrict access to trusted users.
Risk Assessment
Risk of system takeover by an unauthorized attacker if the application uses Apache Lucy and is publicly accessible. Lack of support means no patch.
Recommendation
Stop using Apache Lucy and migrate to an actively supported solution. If necessary, restrict access to the instance to trusted users only.
Original NVD description (English source)
** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.