EUVD-2026-53190
GHSA-7wjr-wh6f-62xm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable library processing external input with no auth required; CWE-789 in C yields high availability impact and potential low-severity memory disclosure.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
1DescriptionCVE.org
UNSUPPORTED WHEN ASSIGNED Memory Allocation with Excessive Size Value vulnerability in Apache Lucy.
This issue affects Apache Lucy: all versions.
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
AnalysisAI
Memory allocation with excessive size value in Apache Lucy (all versions) enables potential denial-of-service and information disclosure against a retired, unsupported search library. The vulnerability stems from CWE-789, where the library processes externally supplied size values without adequate bounds checking, potentially allowing an attacker to trigger abnormal memory allocation behaviour. No patch will ever be released - the Apache Software Foundation has officially retired Lucy and explicitly recommends migration to an alternative; no public exploit has been identified at time of analysis.
Technical ContextAI
Apache Lucy is a retired C-language port of the Apache Lucene search engine library, covering all released versions per CPE cpe:2.3:a:apache_software_foundation:apache_lucy:*:*:*:*:*:*:*:*. CWE-789 (Allocation of Resources Without Limits or Throttling - Memory Allocation with Excessive Size Value) describes a class of vulnerability where an application uses an attacker-controlled or unvalidated value as the size argument to a memory allocation function (e.g. malloc/calloc). This can exhaust process heap memory causing crashes, or in some C-level implementations, cause integer wrap-around leading to undersized allocations and subsequent heap corruption or out-of-bounds reads - consistent with the 'Information Disclosure' tag associated with this CVE. The retired status of the project means no security maintenance is performed and no defensive code changes are planned.
RemediationAI
No vendor-released patch has been identified at time of analysis, and no patch will be released - the project is permanently retired. The Apache Software Foundation's formal recommendation is to migrate to an actively maintained alternative search library (such as Apache Lucene for JVM environments or other actively supported search solutions). As an interim compensating control, restrict network access to any Lucy-backed service to trusted, authenticated users only via firewall rules or network segmentation; this limits the attack surface to already-trusted principals and reduces unauthenticated exposure. A second compensating control is to deploy the Lucy instance behind an authenticated reverse proxy so that size values passed to the library originate only from vetted requests - note this adds operational overhead and does not eliminate the flaw. Neither workaround constitutes a fix; migration remains the only durable resolution. Advisory: https://lists.apache.org/thread/4q9rfscp3tkjr3kt7lsg97szhmydl23s
More in Apache Lucy
View allInsecure deserialization (CWE-502) in Apache Lucy affects all versions of this retired full-text search engine library,
Stack-based buffer overflow in Apache Lucy (all versions) enables potential arbitrary code execution through crafted inp
Uncontrolled Recursion in Apache Lucy, a retired full-text search library, enables remote unauthenticated attackers to c
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today