---
id: CVE-2026-61486
title: >-
  ** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in
  Apache Lucy.




  This issue affects Apache Lucy: all versions.




  As this project is retired, we do not plan to release a version that fixes
  this issue
summary: >-
  ** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in
  Apache Lucy.




  This issue affects Apache Lucy: all versions.




  As this project is retired, we do not plan to release a version that fixes
  this issue. Users ar…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-121
vendor: apache
product: lucy
affected:
  - lucy
published: '2026-08-05'
updated: '2026-09-04'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-61486'
references:
  - url: 'https://lists.apache.org/thread/z88yv1z19ppsd4td4nqtg7q72fvqh01b'
    label: security@apache.org
  - url: 'http://www.openwall.com/lists/oss-security/2026/08/05/7'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.00807
epssPercentile: 0.54928
ingestedAt: '2026-09-05T15:41:16.310Z'
---

## Overview

** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apache Lucy.



This issue affects Apache Lucy: all versions.



As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.



Lucy is now maintained outside of the ASF 
at https://github.com/lucysearch . This issue has been fixed in 0.8.0 there.



NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

## Affected

- `lucy`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.