Security Advisories (4)
CVE-2026-61483 (2026-08-05)

Apache Lucy: QueryParser unbounded recursion on deeply-nested query -> C-stack-overflow DoS ** UNSUPPORTED WHEN ASSIGNED ** Uncontrolled Recursion vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVE-2026-61485 (2026-08-05)

Apache Lucy: Freezer/InStream deserialization bomb - unbounded allocation reading an index ** UNSUPPORTED WHEN ASSIGNED ** Uncontrolled Recursion vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVE-2026-61486 (2026-08-05)

Apache Lucy: stack-buffer-overflow in JSON parser error reporter on malformed input ** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVE-2026-61484 (2026-08-05)

Apache Lucy: LucyX::Remote::SearchServer unauthenticated remote Storable::thaw -> RCE/DoS ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

NAME

Lucy::Search::Query - A specification for a search query.

SYNOPSIS

# Query is an abstract base class.
package MyQuery;
use base qw( Lucy::Search::Query );

sub make_compiler {
    my ( $self, %args ) = @_;
    my $subordinate = delete $args{subordinate};
    my $compiler = MyCompiler->new( %args, parent => $self );
    $compiler->normalize unless $subordinate;
    return $compiler;
}

package MyCompiler;
use base ( Lucy::Search::Compiler );
...

DESCRIPTION

Query objects are simple containers which contain the minimum information necessary to define a search query.

The most common way to generate Query objects is to feed a search string such as 'foo AND bar' to a QueryParser's parse() method, which outputs an abstract syntax tree built up from various Query subclasses such as ANDQuery and TermQuery. However, it is also possible to use custom Query objects to build a search specification which cannot be easily represented using a search string.

Subclasses of Query must implement make_compiler(), which is the first step in compiling a Query down to a Matcher which can actually match and score documents.

CONSTRUCTORS

new( [labeled params] )

my $query = MyQuery->SUPER::new(
    boost => 2.5,
);

Abstract constructor.

  • boost - A scoring multiplier, affecting the Query's relative contribution to each document's score. Typically defaults to 1.0, but subclasses which do not contribute to document scores such as NOTQuery and MatchAllQuery default to 0.0 instead.

ABSTRACT METHODS

make_compiler( [labeled params] )

Abstract factory method returning a Compiler derived from this Query.

  • searcher - A Searcher.

  • boost - A scoring multiplier.

  • subordinate - Indicates whether the Query is a subquery (as opposed to a top-level query). If false, the implementation must invoke normalize() on the newly minted Compiler object before returning it.

METHODS

set_boost(boost)

Set the Query's boost.

get_boost()

Get the Query's boost.

INHERITANCE

Lucy::Search::Query isa Clownfish::Obj.