CVE-2026-61484: Apache Lucy: LucyX::Remote::SearchServer unauthenticated remote Storable::thaw -> RCE/DoS
UNSUPPORTED WHEN ASSIGNED Deserialization of Untrusted Data vulnerability in Apache Lucy.
This issue affects Apache Lucy: all versions.
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
Lucy is now maintained outside of the ASF at https://github.com/lucysearch . 0.8.0 is no longer affected by this issue, because the offending feature has been removed there.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Because Apache Lucy all versions are affected and no fix is planned, restrict access to the Apache Lucy instance to trusted users only (e.g., lock down the network/management endpoints so unauthenticated access to LucyX::Remote::SearchServer / LucyX::mote::SearchServer is not permitted).
- Compensating control
Find an alternative product to Apache Lucy, since the project is retired and the maintainer does not plan to release a fixing version.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-61484?
CVE-2026-61484 has a risk score of 89, indicating it poses a high security threat.
What is the nature of the vulnerability in CVE-2026-61484?
CVE-2026-61484 is a deserialization of untrusted data vulnerability that can lead to remote code execution or denial of service.
How do I mitigate the risks associated with CVE-2026-61484?
To mitigate CVE-2026-61484, users are advised to restrict access to the affected service or find an alternative to Apache Lucy.
Is there a patch available for CVE-2026-61484?
No, CVE-2026-61484 is unsupported, and no patch will be released since Apache Lucy is a retired project.
Which versions of Apache Lucy are affected by CVE-2026-61484?
CVE-2026-61484 affects all versions of Apache Lucy.