Description
this attack requires control over the search index, which is considered fully trusted by Lucy.
Published: 2026-08-05
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

this attack requires control over the search index, which is considered fully trusted by Lucy.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Migrate to a supported alternative to Apache Lucy.
  • If migration is not possible, restrict all access to the Lucy instance and its deserialization endpoints to trusted users only.
  • Implement process or container resource limits to cap memory usage when the Lucy service is running.
  • Monitor memory consumption of the Lucy process for abnormal spikes that could indicate an attempted deserialization attack.

Generated by OpenCVE AI on August 5, 2026 at 16:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References

No reference.

History

Fri, 04 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Title Apache Lucy: Freezer/InStream deserialization bomb - unbounded allocation reading an index
Weaknesses CWE-789
CPEs cpe:2.3:a:apache:lucy:*:*:*:*:*:*:*:*
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 04 Sep 2026 16:00:00 +0000

Type Values Removed Values Added
Description ** UNSUPPORTED WHEN ASSIGNED ** Memory Allocation with Excessive Size Value vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. this attack requires control over the search index, which is considered fully trusted by Lucy.

Wed, 05 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 05 Aug 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache lucy
Vendors & Products Apache
Apache lucy

Wed, 05 Aug 2026 07:30:00 +0000

Type Values Removed Values Added
Description ** UNSUPPORTED WHEN ASSIGNED ** Memory Allocation with Excessive Size Value vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Title Apache Lucy: Freezer/InStream deserialization bomb - unbounded allocation reading an index
Weaknesses CWE-789
References

Subscriptions

Apache Lucy
cve-icon MITRE

Status: REJECTED

Assigner: apache

Published:

Updated: 2026-09-04T15:57:30.493Z

Reserved: 2026-07-10T12:23:21.927Z

Link: CVE-2026-61485

cve-icon Vulnrichment

Updated:

cve-icon NVD

Status : Rejected

Published: 2026-08-05T08:16:35.610

Modified: 2026-09-04T16:17:27.370

Link: CVE-2026-61485

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T17:00:12Z

Weaknesses

No weakness.