Apache Lucy allows a deserialization bomb that leads to an unbounded allocation of memory while reading an index. The flaw is a classic instance of CWE-789, where the program allocates a buffer size based solely on an external value without enforcing limits. An attacker could provide a maliciously crafted index or InStream that triggers the allocation, causing the Lucy instance to consume excessive memory and possibly crash, resulting in a denial of service.

All released versions of Apache Lucy are affected. The project is currently retired, and no further versions will contain a fix. Users are advised to migrate to a supported alternative or, if migration is infeasible, restrict access to the indexed data to trusted insiders.

The vulnerability has a CVSS score of 7.5, indicating a high severity. The EPSS score is 0.00149 (<1%), which is low but not zero, suggesting limited but existent exploitation probability. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation. Nevertheless, the flaw can be exploited by an attacker who can provide input to the deserialization process, forcing the application into an unbounded allocation that may exhaust system memory. The attack vector is inferred to be remote if the Lucy instance is exposed over a network or accessible by untrusted users, but this conclusion is drawn from contextual clues rather than explicit statement. Lack of an official patch means that the risk remains persistent until remediated through replacement or hardening.