CVE-2026-61485: Apache Lucy: Fezer/InStam deserialization bomb - unbounded allocation ading an index
Rejected reason: this attack requires control over the search index, which is considered fully trusted by Lucy.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Because Apache Lucy all versions are affected and no fixed version is planned, restrict access to the Apache Lucy instance to trusted users only (e.g., via network access controls/ACLs) and consider replacing the unsupported product with an alternative.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-61485?
CVE-2026-61485 has a risk score of 47, indicating a moderate severity vulnerability.
How do I fix CVE-2026-61485?
There is no fix for CVE-2026-61485 as Apache Lucy is unsupported and users are advised to find alternative solutions.
What versions of Apache Lucy are affected by CVE-2026-61485?
All versions of Apache Lucy are affected by CVE-2026-61485 due to the unsupported status of the project.
What type of vulnerability is CVE-2026-61485?
CVE-2026-61485 is a Memory Allocation vulnerability that can lead to excessive memory usage through deserialization.
What should users do in response to CVE-2026-61485?
Users should restrict access to the affected Apache Lucy deployments or consider migrating to alternative software.