Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-61484: Apache Lucy: Untrusted Data Can Crash the Server

CVE-2026-61484 · published 1 month ago

Summary

Apache Lucy is a retired project, which means it won't receive any updates or fixes. This means that all versions of Apache Lucy are vulnerable to a security issue that can cause the server to crash. To stay safe, consider switching to a different product or limiting access to trusted users.

What to do

Update apache software foundation apache lucy to version * or later.

Affected software

Vendor	Product	Affected versions
apache software foundation	apache lucy	< *
apache	lucy	All versions `cpe:2.3:a:apache:lucy::::::::`

Original advisory text

** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to rel...

** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy.

This issue affects Apache Lucy: all versions.

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.

Lucy is now maintained outside of the ASF at https://github.com/lucysearch . 0.8.0 is no longer affected by this issue, because the offending feature has been removed there.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

References

http://www.openwall.com/lists/oss-security/2026/08/05/5 Mailing List Third Party Advisory
https://lists.apache.org/thread/942t3pwgz2nrhnklrtyt5zr7g4wqc9cb Mailing List Vendor Advisory

Severity

9.8 Critical

Exploitation

EPSS <1%

Type

CWE-502Deserialization of Untrusted Data

Timeline

Published5 Aug 2026

Updated4 Sep 2026

First seen5 Aug 2026

Sources

CVE-2026-61484 · NVD

CVE-2026-61484 · MITRE

Monitor software like this

Free during beta