Apache Lucy vulnerabilities

Apache Lucy (all versions) contains a stack-based buffer overflow vulnerability. The project is retired, and a fix has been released in version 0.8.0 in the repository outside the ASF.

Apache Lucy (all versions) contains a deserialization of untrusted data vulnerability. The project is retired, and the offending feature has been removed in version 0.8.0 outside the ASF.

Apache Lucy (all versions) contains an uncontrolled recursion vulnerability. The project is retired and no fix is planned. Users are recommended to find an alternative or restrict access to trusted users.