CVE-2026-61485

CVE-2026-61485

published August 5, 2026

CVSS
7.5
EPSS
1%
Percentile
47.3
In the wild
Unconfirmed
What it is

Rejected reason: this attack requires control over the search index, which is considered fully trusted by Lucy.

The record
Technical detail
CVSS
7.5 · NONE
CVSS v4.0
Not supplied
EPSS
0.00617 · 47.3th percentile
Published
2026-08-05T12:16Z
EPSS history
Timeline
  • 05 AUG 06:43Z
    Apache Lucy: Freezer/InStream deserialization bomb - unbounded allocation reading an index
    cvelistv5