CVE-2026-61485
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
A Memory Allocation with Excessive Size Value vulnerability in Apache Lucy affects all versions. As the project is retired, no fix will be released.
Risk Assessment
The risk is that the vulnerability could be exploited to cause crashes or potential code execution, but since the project is unsupported, organizations using Apache Lucy remain exposed to unpatched flaws.
Recommendation
It is recommended to find an alternative to Apache Lucy or restrict access to the instance to trusted users, as no patch will be released.
Other vulnerabilities in Apache Lucy
See all- CVE-2026-61486Critical
Stack-based buffer overflow vulnerability in Apache Lucy affects all versions. The project is retired and no fix will be released. Users are advised to find an alternative or restrict access to trusted users.
- CVE-2026-61484Critical
Deserialization of untrusted data vulnerability in Apache Lucy. The project is retired and no fix is planned. Users are advised to find an alternative or restrict access to trusted users.
- CVE-2026-61483High
Apache Lucy (retired project) has an uncontrolled recursion vulnerability in all versions. The project is no longer supported, so no fix will be released. Users are advised to find an alternative or restrict access to trusted users.
Original NVD description (English source)
** UNSUPPORTED WHEN ASSIGNED ** Memory Allocation with Excessive Size Value vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.