CVE-2026-61484

Apache Lucy is vulnerable to a Deserialization of Untrusted Data vulnerability across all versions. The root cause involves unauthenticated remote Storable::thaw calls within the LucyX::Remote::SearchServer component, which can lead to Remote Code Execution (RCE) or Denial of Service (DoS) . Beca...

CVE-2026-61483

CVE-2026-61483 affects Apache Lucy (all versions). The entry describes an Uncontrolled Recursion vulnerability in the QueryParser that can lead to a C-stack overflow DoS when processing deeply-nested queries. The issue is tied to Apache Lucy being retired; there will be no fixed release, and guid...

CVE-2026-61486

A Stack-based Buffer Overflow vulnerability exists in the JSON parser error reporter of Apache Lucy when processing malformed input. This issue affects all versions of Apache Lucy, but notably only impacts products no longer supported by the maintainer. Because the project is retired, the maintai...