Security Advisories (4)
CVE-2026-61484 (2026-08-05)

Apache Lucy: LucyX::Remote::SearchServer unauthenticated remote Storable::thaw -> RCE/DoS ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVE-2026-61483 (2026-08-05)

Apache Lucy: QueryParser unbounded recursion on deeply-nested query -> C-stack-overflow DoS ** UNSUPPORTED WHEN ASSIGNED ** Uncontrolled Recursion vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVE-2026-61485 (2026-08-05)

Apache Lucy: Freezer/InStream deserialization bomb - unbounded allocation reading an index ** UNSUPPORTED WHEN ASSIGNED ** Uncontrolled Recursion vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVE-2026-61486 (2026-08-05)

Apache Lucy: stack-buffer-overflow in JSON parser error reporter on malformed input ** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

NAME

LucyX::Search::Filter - Build a caching filter based on results of a Query.

SYNOPSIS

my %category_filters;
for my $category (qw( sweet sour salty bitter )) {
    my $cat_query = Lucy::Search::TermQuery->new(
        field => 'category',
        term  => $category,
    );
    $category_filters{$category} = LucyX::Search::Filter->new( 
        query => $cat_query, 
    );
}

while ( my $cgi = CGI::Fast->new ) {
    my $user_query = $cgi->param('q');
    my $filter     = $category_filters{ $cgi->param('category') };
    my $and_query  = Lucy::Search::ANDQuery->new;
    $and_query->add_child($user_query);
    $and_query->add_child($filter);
    my $hits = $searcher->hits( query => $and_query );
    ...

DESCRIPTION

A Filter is a Lucy::Search::Query subclass that can be used to filter the results of another Query. The effect is very similar to simply using the wrapped inner query, but there are two important differences:

  • A Filter does not contribute to the score of the documents it matches.

  • A Filter caches its results, so it is more efficient if you use it more than once.

To obtain logically equivalent results to the Filter but avoid the caching, substitute the wrapped query but use set_boost() to set its boost to 0.

METHODS

new

my $filter = LucyX::Search::Filter->new(
    query => $query;
);

Constructor. Takes one hash-style parameter, query, which must be an object belonging to a subclass of Lucy::Search::Query.

BUGS

Filters do not cache when used in a search cluster with LucyX::Remote's SearchServer and SearchClient.