CVE-2026-61485

CVE-2026-61485 is a memory allocation vulnerability in Apache Lucy with a CVSS 7.5 rating, but there's a critical twist: the project was already end-of-life when this CVE was assigned. Apache has explicitly declined to patch it, marking the vulnerability 'unsupported when assigned.' This changes everything about how you should respond. The EPSS score of 0.00522 will tempt you to deprioritize—this is the trap. Standard vulnerability metrics assume a remediation pathway exists. When Apache Lucy is retired with no fix planned, the CVSS score becomes a compliance artifact, not an operational guide. A 7.5 severity with no patch is not 'medium risk you can accept'—it's an unfixable condition that either demands emergency removal or careful isolation. The vulnerability description—'memory allocation with excessive size value'—is deliberately vague. This matters: vague descriptions in abandoned projects historically correlate with undercharacterized impact. You cannot assume this is a benign DoS. In practice, requesting excessive memory in a garbage-collected environment may safely fail and cause denial of service, but inconsistent error handling could cascade into use-after-free conditions. Without vendor clarification, treat the impact as potentially worse than the description implies. Your immediate actions: First, determine whether Apache Lucy is actually in your environment. It's often an embedded library in downstream products, not a standalone service—so check your dependency graphs, not just your application inventory. Second, assess exposure: is Lucy reachable by untrusted input, or only by tightly-controlled internal services? Third, if Lucy is embedded in a product you didn't build, check whether that downstream product has its own update path or whether this CVE now freezes your remediation timeline. The 'restrict access to trusted users' mitigation Apache offered assumes you have granular access control over a search library—which most deployments don't. Automated pipelines, upstream services, and embedded invocations don't respect 'trusted user' boundaries. If you can't isolate Lucy behind a controlled perimeter, strongly consider removal even if it requires rearchitecture. This CVE documents a structural failure: a project reached end-of-life with known vulnerabilities, and the disclosure process generated paperwork without a solution. Your response should be a forced deprecation audit, not a risk-acceptance form. The window for graceful migration has closed—act accordingly.

Reviewed through automated stages and approved by a human before publication.