Security Advisories (4)
CVE-2026-61484 (2026-08-05)

Apache Lucy: LucyX::Remote::SearchServer unauthenticated remote Storable::thaw -> RCE/DoS ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVE-2026-61483 (2026-08-05)

Apache Lucy: QueryParser unbounded recursion on deeply-nested query -> C-stack-overflow DoS ** UNSUPPORTED WHEN ASSIGNED ** Uncontrolled Recursion vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVE-2026-61485 (2026-08-05)

Apache Lucy: Freezer/InStream deserialization bomb - unbounded allocation reading an index ** UNSUPPORTED WHEN ASSIGNED ** Uncontrolled Recursion vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVE-2026-61486 (2026-08-05)

Apache Lucy: stack-buffer-overflow in JSON parser error reporter on malformed input ** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

NAME

Lucy::Docs::DevGuide - Quick-start guide to hacking on Lucy.

DESCRIPTION

The Lucy code base is organized into roughly four layers:

  • Charmonizer - compiler and OS configuration probing.

  • Clownfish - header files.

  • C - implementation files.

  • Host - binding language.

Charmonizer is a configuration prober which writes a single header file, “charmony.h”, describing the build environment and facilitating cross-platform development. It’s similar to Autoconf or Metaconfig, but written in pure C.

The “.cfh” files within the Lucy core are Clownfish header files. Clownfish is a purpose-built, declaration-only language which superimposes a single-inheritance object model on top of C which is specifically designed to co-exist happily with variety of “host” languages and to allow limited run-time dynamic subclassing. For more information see the Clownfish docs, but if there’s one thing you should know about Clownfish OO before you start hacking, it’s that method calls are differentiated from functions by capitalization:

Indexer_Add_Doc   <-- Method, typically uses dynamic dispatch.
Indexer_add_doc   <-- Function, always a direct invocation.

The C files within the Lucy core are where most of Lucy’s low-level functionality lies. They implement the interface defined by the Clownfish header files.

The C core is intentionally left incomplete, however; to be usable, it must be bound to a “host” language. (In this context, even C is considered a “host” which must implement the missing pieces and be “bound” to the core.) Some of the binding code is autogenerated by Clownfish on a spec customized for each language. Other pieces are hand-coded in either C (using the host’s C API) or the host language itself.