Apache Lucy
Monthly
Stack-based buffer overflow in Apache Lucy (all versions) enables potential arbitrary code execution through crafted input triggering memory corruption in the retired C-based search library. All versions are affected with no patch planned, as the Apache Software Foundation has officially retired the project. No public exploit or active exploitation has been identified at time of analysis, but the absence of any future fix makes this a permanent unresolved risk for any remaining deployments.
Memory allocation with excessive size value in Apache Lucy (all versions) enables potential denial-of-service and information disclosure against a retired, unsupported search library. The vulnerability stems from CWE-789, where the library processes externally supplied size values without adequate bounds checking, potentially allowing an attacker to trigger abnormal memory allocation behaviour. No patch will ever be released - the Apache Software Foundation has officially retired Lucy and explicitly recommends migration to an alternative; no public exploit has been identified at time of analysis.
Insecure deserialization (CWE-502) in Apache Lucy affects all versions of this retired full-text search engine library, allowing an attacker who can supply crafted serialized data to a Lucy-backed application to corrupt reconstructed object state and potentially achieve code execution or logic abuse during deserialization. Because Apache Lucy is retired, the ASF has explicitly declined to ship a fix, so exposure is permanent for any deployment still using it. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Uncontrolled Recursion in Apache Lucy, a retired full-text search library, enables remote unauthenticated attackers to crash the service via a crafted input, resulting in a complete denial of availability across all versions ever released. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms low-complexity, unauthenticated network exploitation with no confidentiality or integrity impact. No patch exists or will be issued by the Apache Software Foundation, as the project is officially retired; EPSS is low at 0.15% (5th percentile) and no active exploitation (CISA KEV) has been identified at time of analysis.
Stack-based buffer overflow in Apache Lucy (all versions) enables potential arbitrary code execution through crafted input triggering memory corruption in the retired C-based search library. All versions are affected with no patch planned, as the Apache Software Foundation has officially retired the project. No public exploit or active exploitation has been identified at time of analysis, but the absence of any future fix makes this a permanent unresolved risk for any remaining deployments.
Memory allocation with excessive size value in Apache Lucy (all versions) enables potential denial-of-service and information disclosure against a retired, unsupported search library. The vulnerability stems from CWE-789, where the library processes externally supplied size values without adequate bounds checking, potentially allowing an attacker to trigger abnormal memory allocation behaviour. No patch will ever be released - the Apache Software Foundation has officially retired Lucy and explicitly recommends migration to an alternative; no public exploit has been identified at time of analysis.
Insecure deserialization (CWE-502) in Apache Lucy affects all versions of this retired full-text search engine library, allowing an attacker who can supply crafted serialized data to a Lucy-backed application to corrupt reconstructed object state and potentially achieve code execution or logic abuse during deserialization. Because Apache Lucy is retired, the ASF has explicitly declined to ship a fix, so exposure is permanent for any deployment still using it. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Uncontrolled Recursion in Apache Lucy, a retired full-text search library, enables remote unauthenticated attackers to crash the service via a crafted input, resulting in a complete denial of availability across all versions ever released. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms low-complexity, unauthenticated network exploitation with no confidentiality or integrity impact. No patch exists or will be issued by the Apache Software Foundation, as the project is officially retired; EPSS is low at 0.15% (5th percentile) and no active exploitation (CISA KEV) has been identified at time of analysis.