CVE-2026-61483
Received Received - Intake

Uncontrolled Recursion in Apache Lucy

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: Apache Software Foundation

Description
** UNSUPPORTED WHEN ASSIGNED ** Uncontrolled Recursion vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-61483
EUVD
EUVD-2026-53168

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache lucy *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an uncontrolled recursion vulnerability in Apache Lucy, a retired search library. The flaw allows excessive recursive calls that could crash the system by consuming resources. Since the project is no longer supported, no fixes will be released.

Detection Guidance

Since Apache Lucy is no longer supported and this vulnerability affects all versions, detection is not straightforward. Check if Apache Lucy is installed on your system using commands like 'which lucy' or 'find / -name lucy 2>/dev/null'. If found, consider it vulnerable as no fixes are available.

Impact Analysis

If you still use Apache Lucy, an attacker could exploit this to cause a denial of service by triggering infinite recursion, leading to system crashes or resource exhaustion. Restricting access to trusted users may mitigate risks.

Compliance Impact

This vulnerability does not directly impact compliance with standards like GDPR or HIPAA since Apache Lucy is already retired and unsupported. The issue only affects unsupported versions, and users are advised to find alternatives or restrict access to trusted users.

Mitigation Strategies

Immediately migrate to an alternative software as Apache Lucy is retired and no patches will be released. Restrict access to any existing Lucy instances to trusted users only as a temporary measure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61483. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart