Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
No data.
No data.
| Vendor | Product | Confidence | Versions | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Apache | Lucy | 95% |
|
Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
No reference.
Fri, 04 Sep 2026 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Apache Lucy: Freezer/InStream deserialization bomb - unbounded allocation reading an index | |
| Weaknesses | CWE-789 | |
| CPEs | ||
| References |
|
|
| Metrics |
cvssV3_1
|
Fri, 04 Sep 2026 16:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | ** UNSUPPORTED WHEN ASSIGNED ** Memory Allocation with Excessive Size Value vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. | this attack requires control over the search index, which is considered fully trusted by Lucy. |
Wed, 05 Aug 2026 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Wed, 05 Aug 2026 10:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Apache
Apache lucy |
|
| Vendors & Products |
Apache
Apache lucy |
Wed, 05 Aug 2026 07:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | ** UNSUPPORTED WHEN ASSIGNED ** Memory Allocation with Excessive Size Value vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. | |
| Title | Apache Lucy: Freezer/InStream deserialization bomb - unbounded allocation reading an index | |
| Weaknesses | CWE-789 | |
| References |
|
MITRE
Status: REJECTED
Assigner: apache
Published:
Updated: 2026-09-04T15:57:30.493Z
Reserved: 2026-07-10T12:23:21.927Z
Link: CVE-2026-61485
Vulnrichment
Updated:
NVD
Status : Rejected
Published: 2026-08-05T08:16:35.610
Modified: 2026-09-04T16:17:27.370
Link: CVE-2026-61485
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-08-05T17:00:12Z
No weakness.