An uncontrolled recursion in Lucy's QueryParser can cause a C‑stack overflow, crashing the application. This vulnerability is a classic CWE‑674 scenario where excessive input depth leads to recursion that exhausts the call stack. As a result, any legitimate or crafted deeply nested query will trigger the crash, causing the service to become unavailable and rendering the system effectively unusable until restarted.

All instances of Apache Lucy, regardless of version, are affected. The project has been retired by the Apache Software Foundation, so no further fixes or updates will be released.

The vulnerability triggers when the QueryParser processes a deeply nested query, causing a C‑stack overflow. Based on the description, it is inferred that any input submitted to the Parser could trigger the failure, implying that an environment exposing Lucy to untrusted queries could experience a DoS. No patch is available and the project is retired, so the risk remains until users replace Lucy or restrict access.