Apache Lucy Excessive Size Value Memory Allocation Vulnerability
CVE-2026-61485 Published on August 5, 2026
Apache Lucy: Freezer/InStream deserialization bomb - unbounded allocation reading an index
** UNSUPPORTED WHEN ASSIGNED ** Memory Allocation with Excessive Size Value vulnerability in Apache Lucy.
This issue affects Apache Lucy: all versions.
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Vulnerability Analysis
CVE-2026-61485 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Weakness Type
What is a Stack Exhaustion Vulnerability?
The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
CVE-2026-61485 has been classified to as a Stack Exhaustion vulnerability or weakness.
Affected Versions
Apache Software Foundation Apache Lucy:- Before and including * is affected.