CVE-2026-61483 Details
Description
** UNSUPPORTED WHEN ASSIGNED ** Uncontrolled Recursion vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the ASF. Lucy is now maintained outside of the ASF at https://github.com/lucysearch
A vulnerability allowing uncontrolled recursion has been identified in Apache Lucy, affecting all versions of the library. This flaw can lead to a stack overflow, causing a denial-of-service condition. As Apache Lucy is a retired project, no official fix will be released. Users are advised to seek alternatives or limit access to trusted individuals.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/08/05/4 | CVE | Mailing ListThird Party Advisory |
| https://github.com/lucysearch | [email protected] | |
| https://lists.apache.org/thread/ltp8320c0nsy45bpzm8342jd7yj05z1h | [email protected] | Mailing ListVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-674 | Uncontrolled Recursion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache lucy | All versions |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 4, 2026 | CVE Modified | [email protected] |
| Sep 4, 2026 | CVE Modified | CVE |
| Aug 6, 2026 | CVE Modified | CISA-ADP |
| Aug 6, 2026 | Initial Analysis | [email protected] |
| Aug 5, 2026 | CVE Modified | CVE |
| Aug 5, 2026 | New CVE Received | [email protected] |