Security Advisories (4)
CVE-2026-61485 (2026-08-05)

Apache Lucy: Freezer/InStream deserialization bomb - unbounded allocation reading an index ** UNSUPPORTED WHEN ASSIGNED ** Uncontrolled Recursion vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVE-2026-61484 (2026-08-05)

Apache Lucy: LucyX::Remote::SearchServer unauthenticated remote Storable::thaw -> RCE/DoS ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVE-2026-61483 (2026-08-05)

Apache Lucy: QueryParser unbounded recursion on deeply-nested query -> C-stack-overflow DoS ** UNSUPPORTED WHEN ASSIGNED ** Uncontrolled Recursion vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVE-2026-61486 (2026-08-05)

Apache Lucy: stack-buffer-overflow in JSON parser error reporter on malformed input ** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

For testing purposes only. Track number of FileHandle objects in existence.

For testing purposes only. Used to help produce buffer alignment tests.

new

my $lock = Lucy::Store::Lock->new(
    name     => 'commit',     # required
    folder   => $folder,      # required
    host     => $hostname,    # required
    timeout  => 5000,         # default: 0
    interval => 1000,         # default: 100
);

Abstract constructor.

  • folder - A Folder.

  • name - String identifying the resource to be locked, which must consist solely of characters matching [-_.A-Za-z0-9].

  • host - A unique per-machine identifier.

  • timeout - Time in milliseconds to keep retrying before abandoning the attempt to obtain() a lock.

  • interval - Time in milliseconds between retries.

my $binding = Clownfish::CFC::Binding::Perl::Class->new(
    parcel     => "Lucy",
    class_name => "Lucy::Store::Lock",
);
$binding->set_pod_spec($pod_spec);

Clownfish::CFC::Binding::Perl::Class->register($binding);
}

sub bind_lockerr { my $pod_spec = Clownfish::CFC::Binding::Perl::Pod->new; my $synopsis = <<'END_SYNOPSIS'; while (1) { my $bg_merger = eval { Lucy::Index::BackgroundMerger->new( index => $index ); }; if ( blessed($@) and $@->isa("Lucy::Store::LockErr") ) { warn "Retrying...\n"; } elsif (!$bg_merger) { # Re-throw. die "Failed to open BackgroundMerger: $@"; } ... } END_SYNOPSIS $pod_spec->set_synopsis($synopsis);

my $binding = Clownfish::CFC::Binding::Perl::Class->new(
    parcel     => "Lucy",
    class_name => "Lucy::Store::LockErr",
);
$binding->set_pod_spec($pod_spec);

Clownfish::CFC::Binding::Perl::Class->register($binding);
}

sub bind_lockfactory { my $pod_spec = Clownfish::CFC::Binding::Perl::Pod->new; my $synopsis = <<'END_SYNOPSIS'; use Sys::Hostname qw( hostname ); my $hostname = hostname() or die "Can't get unique hostname"; my $folder = Lucy::Store::FSFolder->new( path => '/path/to/index', ); my $lock_factory = Lucy::Store::LockFactory->new( folder => $folder, host => $hostname, ); my $write_lock = $lock_factory->make_lock( name => 'write', timeout => 5000, interval => 100, ); END_SYNOPSIS my $constructor = <<'END_CONSTRUCTOR'; my $lock_factory = Lucy::Store::LockFactory->new( folder => $folder, # required host => $hostname, # required ); END_CONSTRUCTOR $pod_spec->set_synopsis($synopsis); $pod_spec->add_constructor( alias => 'new', sample => $constructor, );

my $binding = Clownfish::CFC::Binding::Perl::Class->new(
    parcel     => "Lucy",
    class_name => "Lucy::Store::LockFactory",
);
$binding->set_pod_spec($pod_spec);

Clownfish::CFC::Binding::Perl::Class->register($binding);
}

sub bind_outstream { my $xs_code = <<'END_XS_CODE'; MODULE = Lucy PACKAGE = Lucy::Store::OutStream

void print(self, ...) lucy_OutStream *self; PPCODE: { int i; for (i = 1; i < items; i++) { STRLEN len; char *ptr = SvPV(ST(i), len); LUCY_OutStream_Write_Bytes(self, ptr, len); } }

void write_string(self, aSV) lucy_OutStream *self; SV *aSV; PPCODE: { STRLEN len = 0; char *ptr = SvPVutf8(aSV, len); if (len > INT32_MAX) { CFISH_THROW(CFISH_ERR, "String too long: %u64", (uint64_t)len); } LUCY_OutStream_Write_CU32(self, len); LUCY_OutStream_Write_Bytes(self, ptr, len); } END_XS_CODE

my $binding = Clownfish::CFC::Binding::Perl::Class->new(
    parcel     => "Lucy",
    class_name => "Lucy::Store::OutStream",
);
$binding->bind_constructor( alias => 'open', initializer => 'do_open' );
$binding->append_xs($xs_code);

Clownfish::CFC::Binding::Perl::Class->register($binding);
}

sub bind_ramfilehandle { my $binding = Clownfish::CFC::Binding::Perl::Class->new( parcel => "Lucy", class_name => "Lucy::Store::RAMFileHandle", ); $binding->bind_constructor( alias => '_open', initializer => 'do_open' );

Clownfish::CFC::Binding::Perl::Class->register($binding);
}

sub bind_ramfolder { my $pod_spec = Clownfish::CFC::Binding::Perl::Pod->new; my $synopsis = <<'END_SYNOPSIS'; my $folder = Lucy::Store::RAMFolder->new;

# or sometimes...
my $folder = Lucy::Store::RAMFolder->new(
    path => $relative_path,
);
END_SYNOPSIS
my $constructor = <<'END_CONSTRUCTOR';
my $folder = Lucy::Store::RAMFolder->new(
    path => $relative_path,   # default: empty string
);
END_CONSTRUCTOR
$pod_spec->set_synopsis($synopsis);
$pod_spec->add_constructor( alias => 'new', sample => $constructor, );

my $binding = Clownfish::CFC::Binding::Perl::Class->new(
    parcel     => "Lucy",
    class_name => "Lucy::Store::RAMFolder",
);
$binding->set_pod_spec($pod_spec);

Clownfish::CFC::Binding::Perl::Class->register($binding);
}

1;

1 POD Error

The following errors were encountered while parsing the POD:

Around line 264:

=back doesn't take any parameters, but you said =back END_CONSTRUCTOR $pod_spec->set_synopsis($synopsis); $pod_spec->add_constructor( alias => 'new', pod => $constructor, );