A critical deserialization vulnerability in the retired Apache Lucy project poses a severe risk of remote code execution for any remaining deployments.

This vulnerability involves the deserialization of untrusted data, which occurs without sufficient validation. The flaw is exploitable by an unauthenticated remote attacker who can send malicious payloads to the application.

With a CVSS score of 9.8, this vulnerability is classified as critical. Successful exploitation could lead to full system compromise, including unauthorized data access and complete loss of system integrity or availability. Because the project is retired and no longer supported, the risk is permanent and cannot be remediated through standard vendor patches.

Immediate Action: Since there is no patch available, immediately migrate away from Apache Lucy to a supported alternative. If immediate migration is impossible, restrict network access to the affected instances to prevent external exploitation.

Proactive Monitoring: Monitor network traffic and application logs for unusual deserialization patterns or unexpected process execution.

Compensating Controls: Deploy a Web Application Firewall to filter malicious traffic, although this may not provide comprehensive protection against deserialization attacks.

Public Exploit Available: Unknown

The Apache Lucy project is deprecated and no longer receives security maintenance. Organizations still utilizing this software should prioritize an immediate transition to a modern, supported search engine or data processing library to eliminate this critical risk.