CVE-2026-61486

** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. Lucy is now maintained outside of the ASF at https://github.com/lucysearch . This issue has been fixed in 0.8.0 there. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/z88yv1z19ppsd4td4nqtg7q72fvqh01b	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/08/05/7	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:lucy:*:*:*:*:*:*:*:*

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) NO SOPORTADO CUANDO ASIGNADO Vulnerabilidad de desbordamiento de búfer basado en pila en Apache Lucy. Este problema afecta a Apache Lucy: todas las versiones. Dado que este proyecto ha sido retirado, no planeamos lanzar una versión que solucione este problema. Se recomienda a los usuarios que encuentren una alternativa o restrinjan el acceso a la instancia a usuarios de confianza. NOTA: Esta vulnerabilidad solo afecta a productos que ya no son compatibles con el mantenedor.

Information

Published : 2026-08-05 08:16

Updated : 2026-10-24 16:10

NVD link : CVE-2026-61486

Mitre link : CVE-2026-61486

CVE.ORG link : CVE-2026-61486

JSON object : View

Products Affected

apache

lucy

CWE

CWE-121

Stack-based Buffer Overflow

{"id": "CVE-2026-61486", "cveTags": [{"tags": ["unsupported-when-assigned"], "sourceIdentifier": "security@apache.org"}], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-61486", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-05T14:15:11.019170Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Lucy", "versions": [{"status": "affected", "version": "0", "lessThan": "0.8.0", "versionType": "semver"}], "packageURL": "pkg:cpan/Lucy", "packageName": "Lucy", "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected"}]}], "published": "2026-08-05T08:16:35.733", "references": [{"url": "https://lists.apache.org/thread/z88yv1z19ppsd4td4nqtg7q72fvqh01b", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/08/05/7", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-121"}]}], "descriptions": [{"lang": "en", "value": "** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apache Lucy.\n\n\n\nThis issue affects Apache Lucy: all versions.\n\n\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\n\n\nLucy is now maintained outside of the ASF \nat\u00a0https://github.com/lucysearch . This issue has been fixed in 0.8.0 there.\n\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer."}, {"lang": "es", "value": " NO SOPORTADO CUANDO ASIGNADO Vulnerabilidad de desbordamiento de b\u00fafer basado en pila en Apache Lucy.\n\nEste problema afecta a Apache Lucy: todas las versiones.\n\nDado que este proyecto ha sido retirado, no planeamos lanzar una versi\u00f3n que solucione este problema. Se recomienda a los usuarios que encuentren una alternativa o restrinjan el acceso a la instancia a usuarios de confianza.\n\nNOTA: Esta vulnerabilidad solo afecta a productos que ya no son compatibles con el mantenedor."}], "lastModified": "2026-10-24T16:10:00.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:lucy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3F64401B-1BD7-41CF-A791-E87B631A82B5"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}