CVE-2026-61483

CVE-2026-61483: Apache Lucy: QueryParser unbounded recursion on deeply-nested query -> C-stack-overflow DoS

Vendor Apache Software Foundation

Product Apache Lucy

Weakness CWE-674

Published August 5, 2026

Last update August 6, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

** UNSUPPORTED WHEN ASSIGNED ** Uncontrolled Recursion vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Key dates

02Disclosure timeline

August 5, 2026 CVE published

August 6, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-61483 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/674.html AskarLabs — CWE-674 write-up Uncontrolled Recursion