CVE-2026-61486
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
Stack-based buffer overflow vulnerability in Apache Lucy affects all versions. The project is retired and no fix will be released. Users are advised to find an alternative or restrict access to trusted users.
Risk Assessment
The risk stems from lack of support and patch — an attacker could exploit the buffer overflow for remote code execution or system crash. The organization is exposed to uncontrolled consequences as the vulnerability remains unpatched.
Recommendation
It is recommended to immediately stop using Apache Lucy and migrate to an actively supported solution. If not possible, restrict access to the instance to trusted users only and monitor the system for anomalies.
Original NVD description (English source)
** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.