CVE-2026-61486

EUVD-2026-53191

05.08.2026, 08:16

** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apache Lucy.



This issue affects Apache Lucy: all versions.



As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.



Lucy is now maintained outside of the ASF 
at https://github.com/lucysearch . This issue has been fixed in 0.8.0 there.



NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 48.96%

Affected Products (NVD)

Vendor	Product	Version
apache	lucy	*

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-121 - Stack-based Buffer Overflow
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

References

https://lists.apache.org/thread/z88yv1z19ppsd4td4nqtg7q72fvqh01b

http://www.openwall.com/lists/oss-security/2026/08/05/7