this attack requires control over the search index, which is considered fully trusted by Lucy.

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Apache
  • Lucy

No data.

No data.

References

No reference.

History

Fri, 04 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Title Apache Lucy: Freezer/InStream deserialization bomb - unbounded allocation reading an index
Weaknesses CWE-789
CPEs cpe:2.3:a:apache:lucy:*:*:*:*:*:*:*:*
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 04 Sep 2026 16:00:00 +0000

Type Values Removed Values Added
Description ** UNSUPPORTED WHEN ASSIGNED ** Memory Allocation with Excessive Size Value vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. this attack requires control over the search index, which is considered fully trusted by Lucy.

Wed, 05 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 05 Aug 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache lucy
Vendors & Products Apache
Apache lucy

Wed, 05 Aug 2026 07:30:00 +0000

Type Values Removed Values Added
Description ** UNSUPPORTED WHEN ASSIGNED ** Memory Allocation with Excessive Size Value vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Title Apache Lucy: Freezer/InStream deserialization bomb - unbounded allocation reading an index
Weaknesses CWE-789
References
cve-icon MITRE

Status: REJECTED

Assigner: apache

Published: 2026-08-05T06:43:27.608Z

Updated: 2026-09-04T15:57:30.493Z

Reserved: 2026-07-10T12:23:21.927Z

Link: CVE-2026-61485

cve-icon Vulnrichment

Updated:

cve-icon NVD

Status : Rejected

Published: 2026-08-05T08:16:35.610

Modified: 2026-09-04T16:17:27.370

Link: CVE-2026-61485

cve-icon Redhat

No data.