VulnSocial

CVE-2026-61486Disclosure(apache / lucy)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch apache lucy systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. Lucy is now maintained outside of the ASF at https://github.com/lucysearch . This issue has been fixed in 0.8.0 there. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

apache CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-121

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • lucy

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
apache
Products
lucy

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-08-06: 1Patch / Workaround · 2026-08-06: 1Technical Details · 2026-08-06: 108-06
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • SecAlerts@SecAlertsCo
    Disclosure

    ⚠️ Apache Lucy: CVSS 9.8 stack-buffer-overflow in its JSON parser, no auth needed. The project is retired — no patch is coming. If you're still running it, migrate now. CVE-2026-61486 #cybersecurity #ciso #vulnerabilities #msp https://secalerts.co/vulnerability/CVE-2026-61486?utm_campaign=x https://t.co/yvKMqM4NA0

    Post summary

    This tweet announces a high‑severity (CVSS 9.8) stack‑buffer‑overflow in Apache Lucy’s JSON parser, notes that the project is retired with no patch forthcoming, and urges users to migrate.

    00010131
    876 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appapachelucy---

Explore more

Back to dashboardapache CVEslucy vulnerabilities