CVE-2026-61484
Received Received - Intake

Deserialization of Untrusted Data in Apache Lucy

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: Apache Software Foundation

Description
** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-61484
EUVD
EUVD-2026-53189

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache lucy *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a deserialization of untrusted data vulnerability in Apache Lucy, which is now retired. It affects all versions of the software. The issue arises when untrusted data is deserialized, potentially leading to arbitrary code execution or other malicious activities.

Detection Guidance

Since Apache Lucy is retired and no longer supported, detection involves checking if the software is installed or running on your system. Use commands like 'which lucy' or 'ps aux | grep lucy' to identify instances.

Impact Analysis

Since Apache Lucy is no longer supported, the main impact is if you continue using it. Attackers could exploit this flaw to execute arbitrary code if they gain access to untrusted data. Restricting access to trusted users is recommended to mitigate risks.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as Apache Lucy is retired and no longer supported. Users are advised to find alternatives or restrict access to trusted users to mitigate risks.

Mitigation Strategies

Migrate to an alternative solution as Apache Lucy is no longer maintained. Restrict access to any existing instances to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61484. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart