EUVD-2026-53168
GHSA-3rc9-h6hx-fvf7
Severity by source
Sources disagree (Low–High)AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable unauthenticated DoS with no authentication barrier, no confidentiality or integrity impact, and availability fully compromised on crash.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4DescriptionNVD
UNSUPPORTED WHEN ASSIGNED Uncontrolled Recursion vulnerability in Apache Lucy.
This issue affects Apache Lucy: all versions.
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
AnalysisAI
Uncontrolled Recursion in Apache Lucy, a retired full-text search library, enables remote unauthenticated attackers to crash the service via a crafted input, resulting in a complete denial of availability across all versions ever released. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms low-complexity, unauthenticated network exploitation with no confidentiality or integrity impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond network reachability - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation against any network-exposed Apache Lucy instance running any version, with no non-default configuration or specific feature enablement stated as a prerequisite. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Despite the CVSS 7.5 High score, real-world prioritization should be tempered by several signals. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A remote attacker with no credentials sends a specially crafted search query or malformed document to a network-accessible Apache Lucy instance, designed to trigger deeply nested recursive processing within the library's parsing or query evaluation logic. The recursion proceeds without bound, exhausting the process stack until the Lucy service crashes, denying search functionality to all legitimate users. … |
| Remediation | No vendor-released patch exists and none will be issued; the Apache Software Foundation explicitly confirmed this via the advisory at https://lists.apache.org/thread/ltp8320c0nsy45bpzm8342jd7yj05z1h. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all systems and applications to identify whether Apache Lucy is deployed in production or development environments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Lucy
View allInsecure deserialization (CWE-502) in Apache Lucy affects all versions of this retired full-text search engine library,
Memory allocation with excessive size value in Apache Lucy (all versions) enables potential denial-of-service and inform
Stack-based buffer overflow in Apache Lucy (all versions) enables potential arbitrary code execution through crafted inp
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today