CVE-2026-61486
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
Apache Lucy (all versions) contains a stack-based buffer overflow vulnerability. The project is retired, and a fix has been released in version 0.8.0 in the repository outside the ASF.
Risk Assessment
The vulnerability could allow remote code execution or cause a crash, but it only affects unsupported versions, so risk is limited to environments still using these versions.
Recommendation
It is recommended to find an alternative or restrict access to the instance to trusted users. If possible, update to version 0.8.0 from the LucySearch repository.
Other vulnerabilities in Apache Lucy
See all- CVE-2026-61484Critical
Apache Lucy (all versions) contains a deserialization of untrusted data vulnerability. The project is retired, and the offending feature has been removed in version 0.8.0 outside the ASF.
- CVE-2026-61483High
Apache Lucy (all versions) contains an uncontrolled recursion vulnerability. The project is retired and no fix is planned. Users are recommended to find an alternative or restrict access to trusted users.
Original NVD description (English source)
** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. Lucy is now maintained outside of the ASF at https://github.com/lucysearch . This issue has been fixed in 0.8.0 there. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.