Description
** UNSUPPORTED WHEN ASSIGNED ** Uncontrolled Recursion vulnerability in Apache Lucy.

This issue affects Apache Lucy: all versions.

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Published: 2026-08-05
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An uncontrolled recursion in Lucy's QueryParser can cause a C‑stack overflow, crashing the application. This vulnerability is a classic CWE‑674 scenario where excessive input depth leads to recursion that exhausts the call stack. As a result, any legitimate or crafted deeply nested query will trigger the crash, causing the service to become unavailable and rendering the system effectively unusable until restarted.

Affected Systems

All instances of Apache Lucy, regardless of version, are affected. The project has been retired by the Apache Software Foundation, so no further fixes or updates will be released.

Risk and Exploitability

The vulnerability triggers when the QueryParser processes a deeply nested query, causing a C‑stack overflow. The CVSS score of 7.5 indicates a high severity, and the EPSS score of <1% indicates a very low exploitation likelihood, with no known active exploitation. The issue is not listed in CISA KEV. No patch is available since the project is retired; therefore, the risk remains until users replace Lucy or restrict access to trusted users.

Generated by OpenCVE AI on August 6, 2026 at 20:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Use a modern, supported search library in place of Apache Lucy so the recursion flaw cannot be exercised.
  • Restrict access to the Lucy instance so that only trusted users or internal applications can submit search queries.
  • Continuously monitor application logs for stack‑overflow crashes or abrupt service terminations to detect exploitation attempts as early as possible.

Generated by OpenCVE AI on August 6, 2026 at 20:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 06 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 05 Aug 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache lucy
Vendors & Products Apache
Apache lucy

Wed, 05 Aug 2026 07:30:00 +0000

Type Values Removed Values Added
Description ** UNSUPPORTED WHEN ASSIGNED ** Uncontrolled Recursion vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Title Apache Lucy: QueryParser unbounded recursion on deeply-nested query -> C-stack-overflow DoS
Weaknesses CWE-674
References

Subscriptions

Apache Lucy
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-08-06T17:44:10.394Z

Reserved: 2026-07-10T12:23:21.927Z

Link: CVE-2026-61483

cve-icon Vulnrichment

Updated: 2026-08-05T15:44:11.545Z

cve-icon NVD

Status : Modified

Published: 2026-08-05T08:16:35.330

Modified: 2026-08-06T22:18:11.223

Link: CVE-2026-61483

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-06T20:30:02Z

Weaknesses