CVE-2026-61486CWE-121

CVE-2026-61486

Critical · published August 5, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
56.4
In the wild
Unconfirmed
What it is

** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apache Lucy.

This issue affects Apache Lucy: all versions.

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.

Lucy is now maintained outside of the ASF

at https://github.com/lucysearch . This issue has been fixed in 0.8.0 there.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00807 · 56.4th percentile
Weakness
CWE-121 · Stack-based Buffer Overflow
Published
2026-08-05T12:16Z
Affected products (1)
ProductVersionsFixed in
apache/lucyall versions—
References (2)
https://lists.apache.org/thread/z88yv1z19ppsd4td4nqtg7q72fvqh01b · [email protected]http://www.openwall.com/lists/oss-security/2026/08/05/7 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 05 AUG 06:44Z
    Apache Lucy: stack-buffer-overflow in JSON parser error reporter on malformed input
    cvelistv5