CVE-2026-61484

Apache Lucy is affected by CVE-2026-61484 due to a Deserialization of Untrusted Data vulnerability. The advisory states this affects Lucy: all versions and, because the project is retired, there will be no fix released; users should consider alternatives or restrict access to trusted users. The C...

CVE-2026-61483

CVE-2026-61483 affects Apache Lucy (all versions). The entry describes an Uncontrolled Recursion vulnerability in the QueryParser that can lead to a C-stack overflow DoS when processing deeply-nested queries. The issue is tied to Apache Lucy being retired; there will be no fixed release, and guid...

CVE-2026-61486

Technical details about CVE-2026-61486 are not publicly available in the provided documents. The sources consistently note that Apache Lucy is retired and no fix is planned; monitor for updates.