CVE-2026-61484 Apache Lucy: LucyX::Remote::SearchServer unauthenticated remote Storable::thaw -> RCE/DoS
Unauthenticated attackers can achieve remote code execution or denial of service via unsafe deserialization in the retired Apache Lucy library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-61484?
CVE-2026-61484 is a critical unsafe deserialization vulnerability in Apache Lucy, published on 5 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy.
This issue affects Apache Lucy: all versions.
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
Lucy is now maintained outside of the ASF at https://github.com/lucysearch . 0.8.0 is no longer affected by this issue, because the offending feature has been removed there.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Weakness: CWE-502
Which versions are affected by CVE-2026-61484?
It affects 1 product.
Products include Apache Lucy.
How do I fix CVE-2026-61484?
No fix has been published for CVE-2026-61484 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-61484 being exploited?
There is no known exploitation of CVE-2026-61484 in the wild and no public exploit code.
Other vulnerabilities in Apache Lucy
Sources
Also known as GHSA-q347-vr2h-mpmx.