What is the CVSS score of EUVD-2026-53168?

EUVD-2026-53168 has a contested CVSS base score of 7.5 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Apache Lucy are affected by EUVD-2026-53168?

Apache Lucy, a retired full-text search library, contains an uncontrolled recursion vulnerability allowing unauthenticated remote attackers to crash any application that depends on it.

How to fix or mitigate EUVD-2026-53168?

Within 24 hours, audit all systems and applications to identify whether Apache Lucy is deployed in production or development environments. Within 7 days, initiate migration planning to replace Lucy with a maintained alternative (Elasticsearch 8.x, OpenSearch, or Apache Solr 9.x); if immediate replacement is not feasible, implement emergency network segmentation restricting Lucy instances to trusted internal systems only and deploy application-layer input validation with recursion depth limits. Complete migration to a supported search library within 30 days; maintain compensating controls until full decommissioning.

Apache Lucy EUVD-2026-53168

| CVE-2026-61483 HIGH

Uncontrolled Recursion (CWE-674)

2026-08-05 apache

GHSA-3rc9-h6hx-fvf7

Apache Information Disclosure Apache Lucy Apache Software Foundation

High

Disputed · 7.5 NVD

Severity by source

Sources disagree (Low–High)

Vendor (apache) PRIMARY

LOW

qualitative

NVD

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable unauthenticated DoS with no authentication barrier, no confidentiality or integrity impact, and availability fully compromised on crash.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 06, 2026 - 18:58 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 06, 2026 - 18:52 vuln.today

cvss_changed

CVSS changed

Aug 06, 2026 - 18:52 NVD

7.5 (HIGH)

Analysis Generated

Aug 05, 2026 - 07:45 vuln.today

DescriptionNVD

UNSUPPORTED WHEN ASSIGNED Uncontrolled Recursion vulnerability in Apache Lucy.

This issue affects Apache Lucy: all versions.

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

Uncontrolled Recursion in Apache Lucy, a retired full-text search library, enables remote unauthenticated attackers to crash the service via a crafted input, resulting in a complete denial of availability across all versions ever released. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms low-complexity, unauthenticated network exploitation with no confidentiality or integrity impact. No patch exists or will be issued by the Apache Software Foundation, as the project is officially retired; EPSS is low at 0.15% (5th percentile) and no active exploitation (CISA KEV) has been identified at time of analysis.

Technical ContextAI

Apache Lucy is a retired full-text search engine library from the Apache Software Foundation, identified by CPE cpe:2.3:a:apache_software_foundation:apache_lucy:*:*:*:*:*:*:*:*. CWE-674 (Uncontrolled Recursion) describes a failure to impose depth limits or termination conditions on recursive processing - typically in parsing, query evaluation, or document indexing pipelines - allowing an attacker to supply input that causes unbounded stack growth, exhausting memory and crashing the process. The network-accessible attack vector (AV:N) suggests this recursion can be triggered remotely through Lucy's query or indexing interface without requiring local access. One data quality note: the intelligence feed tags this as 'Information Disclosure,' which directly conflicts with the CVSS impact metrics (C:N/I:N/A:H); the CVE description and CVSS both point exclusively to availability impact, and the tag should not be treated as confirmation of any confidentiality exposure.

RemediationAI

No vendor-released patch exists and none will be issued; the Apache Software Foundation explicitly confirmed this via the advisory at https://lists.apache.org/thread/ltp8320c0nsy45bpzm8342jd7yj05z1h. Migration to an actively maintained alternative full-text search library (such as Apache Solr, Elasticsearch, or Lucene directly) is the only durable fix and is the vendor's recommended path. If immediate migration is not feasible, restrict all network access to Apache Lucy instances to explicitly trusted hosts and internal networks using firewall rules or VPN - this removes the AV:N attack vector and is the most impactful compensating control, though it introduces operational constraints if Lucy is currently public-facing. Additionally, deploying a reverse proxy with request size and query-depth limits can reduce the input surface available for triggering recursion, though this is not a substitute for migration. Both compensating controls leave the underlying vulnerability unaddressed indefinitely.