CVE-2026-61484: Apache Lucy: LucyX::Remote::SearchServer unauthenticated remote Storable::thaw -> RCE/DoS

Published Aug 5, 2026

Updated

UNSUPPORTED WHEN ASSIGNED Deserialization of Untrusted Data vulnerability in Apache Lucy.

This issue affects Apache Lucy: all versions.

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Affected Software

1 affected component

Apache Lucy<=

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Compensating control
Restrict network access to the Apache Lucy instance (including LucyX::Remote::SearchServer) so it is reachable only by trusted users; untrusted/unauthenticated clients should not be able to invoke LucyX::Remote::SearchServer.

Event History

Aug 5, 2026

CVE Published

via MITRE·06:42 AM

Data Sourced

via MITRE·06:42 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2026-61484?

CVE-2026-61484 has a risk score of 89, indicating it poses a high security threat.

What is the nature of the vulnerability in CVE-2026-61484?

CVE-2026-61484 is a deserialization of untrusted data vulnerability that can lead to remote code execution or denial of service.

How do I mitigate the risks associated with CVE-2026-61484?

To mitigate CVE-2026-61484, users are advised to restrict access to the affected service or find an alternative to Apache Lucy.

Is there a patch available for CVE-2026-61484?

No, CVE-2026-61484 is unsupported, and no patch will be released since Apache Lucy is a retired project.

Which versions of Apache Lucy are affected by CVE-2026-61484?

CVE-2026-61484 affects all versions of Apache Lucy.

CVE-2026-61484: Apache Lucy: LucyX::Remote::SearchServer unauthenticated remote Storable::thaw -> RCE/DoS

Affected Software

Remediation

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2026-61484?

What is the nature of the vulnerability in CVE-2026-61484?

How do I mitigate the risks associated with CVE-2026-61484?

Is there a patch available for CVE-2026-61484?

Which versions of Apache Lucy are affected by CVE-2026-61484?

Company

Resources

Contact

Frequently Asked Questions

What is the severity of CVE-2026-61484?

What is the nature of the vulnerability in CVE-2026-61484?

How do I mitigate the risks associated with CVE-2026-61484?

Is there a patch available for CVE-2026-61484?

Which versions of Apache Lucy are affected by CVE-2026-61484?