CVE-2026-61485
Received Received - Intake

Memory Allocation Excess in Apache Lucy

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: Apache Software Foundation

Description
** UNSUPPORTED WHEN ASSIGNED ** Memory Allocation with Excessive Size Value vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-61485
EUVD
EUVD-2026-53190

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache lucy *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a memory allocation vulnerability in Apache Lucy where an excessive size value could lead to improper memory handling. The project is retired and no fixes will be provided. Users should switch to alternatives or restrict access to trusted users only.

Detection Guidance

Since Apache Lucy is retired and no longer supported, detection is not recommended. The project advises finding an alternative or restricting access to trusted users only.

Impact Analysis

Since Apache Lucy is no longer supported, the vulnerability could allow unauthorized memory manipulation if exploited. However, the retired status means no official patches will be released, increasing long-term risk for exposed systems.

Compliance Impact

This vulnerability does not directly impact compliance with standards like GDPR or HIPAA because Apache Lucy is already unsupported and users are advised to find alternatives or restrict access to trusted users. The lack of support means no official patches will be provided to address security issues.

Mitigation Strategies

Immediately stop using Apache Lucy as it is no longer supported. Migrate to an alternative solution and restrict access to the instance to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61485. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart