Security Advisories (4)
CVE-2026-61484 (2026-08-05)

Apache Lucy: LucyX::Remote::SearchServer unauthenticated remote Storable::thaw -> RCE/DoS ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVE-2026-61483 (2026-08-05)

Apache Lucy: QueryParser unbounded recursion on deeply-nested query -> C-stack-overflow DoS ** UNSUPPORTED WHEN ASSIGNED ** Uncontrolled Recursion vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVE-2026-61485 (2026-08-05)

Apache Lucy: Freezer/InStream deserialization bomb - unbounded allocation reading an index ** UNSUPPORTED WHEN ASSIGNED ** Uncontrolled Recursion vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVE-2026-61486 (2026-08-05)

Apache Lucy: stack-buffer-overflow in JSON parser error reporter on malformed input ** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

NAME

Lucy::Index::PostingList - Term-Document pairings.

SYNOPSIS

my $posting_list_reader 
    = $seg_reader->obtain("Lucy::Index::PostingListReader");
my $posting_list = $posting_list_reader->posting_list( 
    field => 'content',
    term  => 'foo',
);
while ( my $doc_id = $posting_list->next ) {
    say "Matching doc id: $doc_id";
}

DESCRIPTION

PostingList is an iterator which supplies a list of document ids that match a given term.

See IRTheory for definitions of “posting” and “posting list”.

ABSTRACT METHODS

get_doc_freq

my $int = $posting_list->get_doc_freq();

Return the number of documents that the PostingList contains. (This number will include any documents which have been marked as deleted but not yet purged.)

seek

$posting_list->seek($target);
$posting_list->seek();  # default: undef

Prepare the PostingList object to iterate over matches for documents that match target.

  • target - The term to match. If undef, the iterator will be empty.

INHERITANCE

Lucy::Index::PostingList isa Lucy::Search::Matcher isa Clownfish::Obj.