CVE-2026-61484

Modified Modified - Updated After Analysis

Deserialization of Untrusted Data in Apache Lucy

Publication date: 2026-08-05

Last updated on: 2026-09-04

Assigner: Apache Software Foundation

Description

** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. Lucy is now maintained outside of the ASF at https://github.com/lucysearch . 0.8.0 is no longer affected by this issue, because the offending feature has been removed there. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-09-04

Generated

2026-09-15

AI Q&A

2026-08-05

EPSS Evaluated

2026-09-14

NVD

CVE-2026-61484

EUVD

EUVD-2026-53189

Affected Vendors & Products

Vendor	Product	Version / Range
apache	lucy	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This is a deserialization of untrusted data vulnerability in Apache Lucy, which is now retired. It affects all versions of the software. The issue arises when untrusted data is deserialized, potentially leading to arbitrary code execution or other malicious activities.

Detection Guidance

Since Apache Lucy is retired and no longer supported, detection involves checking if the software is installed or running on your system. Use commands like 'which lucy' or 'ps aux | grep lucy' to identify instances.

Impact Analysis

Since Apache Lucy is no longer supported, the main impact is if you continue using it. Attackers could exploit this flaw to execute arbitrary code if they gain access to untrusted data. Restricting access to trusted users is recommended to mitigate risks.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as Apache Lucy is retired and no longer supported. Users are advised to find alternatives or restrict access to trusted users to mitigate risks.

Mitigation Strategies

Migrate to an alternative solution as Apache Lucy is no longer maintained. Restrict access to any existing instances to trusted users only.

Hi! I’m here to help you understand CVE-2026-61484. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70