Apache Lucy Uncontrolled Recursion CVE-2026-61483
CVE-2026-61483 Published on August 5, 2026
Apache Lucy: QueryParser unbounded recursion on deeply-nested query -> C-stack-overflow DoS
** UNSUPPORTED WHEN ASSIGNED ** Uncontrolled Recursion vulnerability in Apache Lucy.
This issue affects Apache Lucy: all versions.
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Weakness Type
What is a Stack Exhaustion Vulnerability?
The product does not properly control the amount of recursion which takes place, consuming excessive resources, such as allocated memory or the program stack.
CVE-2026-61483 has been classified to as a Stack Exhaustion vulnerability or weakness.
Affected Versions
Apache Software Foundation Apache Lucy:- Before and including * is affected.