Apache Lucy allows a deserialization bomb that leads to an unbounded allocation of memory while reading an index. The flaw is a classic instance of CWE-789, where the program allocates a buffer size based solely on an external value without enforcing limits. An attacker could provide a maliciously crafted index or InStream that triggers the allocation, causing the Lucy instance to consume excessive memory and possibly crash, resulting in a denial of service.

All released versions of Apache Lucy are affected. The project is currently retired, and no further versions will contain a fix. Users are advised to migrate to a supported alternative or, if migration is infeasible, restrict access to the indexed data to trusted insiders.

The exact EPSS score is not published, but the vulnerability is listed in no CISA KEV catalog, suggesting no known widespread exploitation. Nevertheless, the flaw allows an attacker who can feed input to the deserialization process to force the application into an unbounded allocation, potentially exhausting system memory. If the Lucy instance is exposed over a network or accessible by untrusted users, the threat vector is likely remote. Lack of an official patch means that the risk is persistent until remediated through replacement or hardening.