CVE-2026-61486 Details
Description
** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. Lucy is now maintained outside of the ASF at https://github.com/lucysearch . This issue has been fixed in 0.8.0 there. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
A stack-based buffer overflow vulnerability has been identified in Apache Lucy, affecting all versions of the library. This issue arises in the JSON parser's error reporting mechanism when handling malformed input. As Apache Lucy is a retired project, no official patch will be released. Users are advised to seek alternatives or limit access to trusted individuals.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/08/05/7 | CVE | Mailing ListThird Party Advisory |
| https://lists.apache.org/thread/z88yv1z19ppsd4td4nqtg7q72fvqh01b | [email protected] | Mailing ListVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-121 | Stack-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache lucy | All versions |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 4, 2026 | CVE Modified | [email protected] |
| Sep 4, 2026 | CVE Modified | CVE |
| Aug 6, 2026 | Initial Analysis | [email protected] |
| Aug 5, 2026 | CVE Modified | CVE |
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | [email protected] |