What is the CVSS score of EUVD-2026-53189?

EUVD-2026-53189 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apache Lucy are affected by EUVD-2026-53189?

Apache Lucy, a deprecated full-text search library, exposes organizations to a critical, permanently unpatched code execution vulnerability.

How to fix or mitigate EUVD-2026-53189?

Within 24 hours, inventory all systems, applications, and services currently using Apache Lucy in your infrastructure and map data flows through affected systems. Within 7 days, develop and approve a formal migration plan to replace Lucy with an actively supported alternative (Elasticsearch, Solr, Meilisearch, or equivalent) and implement strict network access controls around Lucy-dependent services. Within 30 days, execute phased migration beginning with systems processing untrusted external input or exposed to internet-facing applications.

Apache Lucy EUVD-2026-53189

| CVE-2026-61484 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-08-05 apache

GHSA-q347-vr2h-mpmx

Apache Deserialization Apache Lucy Apache Software Foundation

9.8

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Deserialization can yield full compromise (C/I/A:H); AC:H because it requires the app to feed untrusted data into Lucy's thaw routines, a non-default condition; PR:N as Lucy defines no auth layer of its own.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 07:51 vuln.today

CVE Published

Aug 05, 2026 - 06:42 cve.org

CRITICAL

DescriptionCVE.org

UNSUPPORTED WHEN ASSIGNED Deserialization of Untrusted Data vulnerability in Apache Lucy.

This issue affects Apache Lucy: all versions.

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Articles & Coverage 1

News Critical Insecure Deserialization in Apache Lucy - CVE-2026-61484 Aug 06, 2026

AnalysisAI

Insecure deserialization (CWE-502) in Apache Lucy affects all versions of this retired full-text search engine library, allowing an attacker who can supply crafted serialized data to a Lucy-backed application to corrupt reconstructed object state and potentially achieve code execution or logic abuse during deserialization. Because Apache Lucy is retired, the ASF has explicitly declined to ship a fix, so exposure is permanent for any deployment still using it. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Technical ContextAI

Apache Lucy is a loose C port of Apache Lucene, providing an embeddable full-text search engine with bindings for Perl and other languages, and it exposes object serialization/deserialization (freeze/thaw) primitives used to persist and reconstruct search objects and index structures. The weakness is CWE-502, Deserialization of Untrusted Data, meaning Lucy reconstructs objects from a serialized byte stream without sufficiently validating that the incoming data is well-formed and originates from a trusted source. When an application feeds attacker-influenced serialized blobs into these thaw/deserialize routines, malformed or hostile input can drive the reconstruction logic into unsafe states. The single reference is an Apache dev-list advisory thread on lists.apache.org, and the affected CPE cpe:2.3:a:apache_software_foundation:apache_lucy:*:*:*:*:*:*:*:* covers every release.

RemediationAI

No vendor-released patch identified at time of analysis, and the ASF has stated it will not release a fixed version because Apache Lucy is retired, so patching is not an option. The primary recommended action per the Apache advisory (https://lists.apache.org/thread/942t3pwgz2nrhnklrtyt5zr7g4wqc9cb) is to migrate off Apache Lucy to a maintained alternative such as Apache Lucene/Solr, Elasticsearch, or OpenSearch. Until migration completes, restrict access to any Lucy-backed instance to trusted users only, and ensure the application never deserializes (thaws) data that originates from untrusted or network-facing sources - feed only index files and blobs the application itself produced and stores in a protected location. As compensating controls, place the service behind authentication and network segmentation so untrusted clients cannot submit serialized payloads, and enforce filesystem permissions on index/serialized data so it cannot be tampered with; the trade-offs are reduced accessibility and the operational overhead of auditing every data path, and none of these controls removes the underlying flaw.