9.8

CVE-2026-61486

Apache Lucy: stack-buffer-overflow in JSON parser error reporter on malformed input

** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apache Lucy.



This issue affects Apache Lucy: all versions.



As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.



Lucy is now maintained outside of the ASF 
at https://github.com/lucysearch . This issue has been fixed in 0.8.0 there.



NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Lucy
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.57% 0.439
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-121 Stack-based Buffer Overflow

A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

https://lists.apache.org/thread/z88yv1z19ppsd4td4nqtg7q72fvqh01b
Vendor Advisory
Mailing List
http://www.openwall.com/lists/oss-security/2026/08/05/7
Third Party Advisory
Mailing List