CVE-2026-61485
Published Aug 5, 2026
CVSS n/a
EPSS n/a
KEV · Not listed
Description
this attack requires control over the search index, which is considered fully trusted by Lucy.
Affected Products
-
CVE record
No data
-
NVD configurations
No data
-
Red Hat packages
No data
-
OpenCVE enrichment
No data
No data.
No data.
No data.
No data available yet.
Remediation
Tracking
Advisories
Metrics
No CVSS v4.0
No CVSS v3.1
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
No EPSS score available.
Key SSVC decision points have not yet been added.
References
No reference.
History
Sep 4, 2026 4:30 PM
Title updated. Weaknesses updated. Affected versions updated. References updated. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Apache Lucy: Freezer/InStream deserialization bomb - unbounded allocation reading an index | |
| Weaknesses | CWE-789 | |
| CPEs | ||
| References |
|
|
| Metrics |
cvssV3_1
|
Sep 4, 2026 4:00 PM
Description updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | ** UNSUPPORTED WHEN ASSIGNED ** Memory Allocation with Excessive Size Value vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. | this attack requires control over the search index, which is considered fully trusted by Lucy. |
Aug 5, 2026 3:30 PM
Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Aug 5, 2026 10:45 AM
First appearance in the feed. Affected vendors updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Apache
Apache lucy |
|
| Vendors & Products |
Apache
Apache lucy |
Aug 5, 2026 7:30 AM
Description updated. Title updated. Weaknesses updated. Added references
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | ** UNSUPPORTED WHEN ASSIGNED ** Memory Allocation with Excessive Size Value vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. | |
| Title | Apache Lucy: Freezer/InStream deserialization bomb - unbounded allocation reading an index | |
| Weaknesses | CWE-789 | |
| References |
|
Weaknesses
No weakness.
