CVE-2026-61484

A critical deserialization flaw in Apache Lucy (CVE-2026-61484, CVSS 9.8) has been assigned and marked 'UNSUPPORTED WHEN ASSIGNED'—meaning no patch will be forthcoming. This is not a typical vulnerability; it's a structural failure in the vulnerability response pipeline that demands different handling than your standard patchable CVE. The core problem: this is a deserialization vulnerability present across all versions of a project that Apache has explicitly abandoned. The 'find an alternative' remediation guidance is technically correct but practically useless for organizations that discovered Lucy embedded in their dependency graph through transitive dependencies, middleware, or container images they didn't directly install. You may be running Lucy without knowing it. The EPSS score of 0.00554 is misleading, not reassuring. Low EPSS for abandoned software typically indicates attackers haven't bothered scanning for it—not that it's been successfully migrated away. Forgotten instances don't generate exploitation telemetry because nobody's watching them. This is the dangerous trap: a low EPSS becomes evidence for 'probably fine' when it's actually evidence for 'probably unmonitored.' The deeper supply chain risk: Lucy depends on Lucene, which remains actively maintained and patched. But Lucy itself never incorporated those upstream fixes. Running Lucy means you're running a version of Lucene with vulnerabilities that have been patched upstream but never backported. The question isn't 'how do I secure this instance'—it's 'what else am I missing that upstream already fixed.' What you should do: treat this as a supply chain discovery problem, not a patch problem. Audit your dependency graphs for direct and transitive Lucy exposure. If found, the only safe path is removal or replacement—even if functionality is working, the unpatchable attack surface compounds over time as adjacent vulnerabilities in Lucene mature. Flag this in your vulnerability management system as 'unpatchable, requires removal' rather than treating it as a standard CVE awaiting remediation.

Reviewed through automated stages and approved by a human before publication.