EUVD-2026-53189
GHSA-q347-vr2h-mpmx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Deserialization can yield full compromise (C/I/A:H); AC:H because it requires the app to feed untrusted data into Lucy's thaw routines, a non-default condition; PR:N as Lucy defines no auth layer of its own.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
UNSUPPORTED WHEN ASSIGNED Deserialization of Untrusted Data vulnerability in Apache Lucy.
This issue affects Apache Lucy: all versions.
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Articles & Coverage 1
AnalysisAI
Insecure deserialization (CWE-502) in Apache Lucy affects all versions of this retired full-text search engine library, allowing an attacker who can supply crafted serialized data to a Lucy-backed application to corrupt reconstructed object state and potentially achieve code execution or logic abuse during deserialization. Because Apache Lucy is retired, the ASF has explicitly declined to ship a fix, so exposure is permanent for any deployment still using it. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application actually deserializes (thaws) attacker-controlled or untrusted serialized data through Apache Lucy's serialization primitives - this is the concrete prerequisite implied by CWE-502 and the advisory. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No CVSS score or vector was published (CVSS N/A), no EPSS score is provided, the flaw is absent from CISA KEV, and no proof-of-concept is referenced, so every quantitative exploitation signal is missing and cannot be compared or ranked. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies an application that embeds Apache Lucy and passes externally-supplied serialized data into Lucy's deserialization (thaw) routines - for example a service that accepts a serialized query object, cached search state, or index fragment from a client. The attacker crafts a malicious serialized blob and submits it, causing Lucy to reconstruct hostile object state and potentially trigger memory corruption or unintended code paths during deserialization. … |
| Remediation | No vendor-released patch identified at time of analysis, and the ASF has stated it will not release a fixed version because Apache Lucy is retired, so patching is not an option. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems, applications, and services currently using Apache Lucy in your infrastructure and map data flows through affected systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Lucy
View allMemory allocation with excessive size value in Apache Lucy (all versions) enables potential denial-of-service and inform
Stack-based buffer overflow in Apache Lucy (all versions) enables potential arbitrary code execution through crafted inp
Uncontrolled Recursion in Apache Lucy, a retired full-text search library, enables remote unauthenticated attackers to c
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today