CVE-2026-61484
High-volume attack activity detected by CloudCoffer UTDS
CVE-2026-61484: unauthenticated attack path to unsafe deserialization.
Executive Alert
CloudCoffer’s UTDS has recently detected a high volume of attack attempts consistent with CVE-2026-61484 across monitored network environments. Because these attacks may target a non-HTTP TCP service and bypass conventional web security controls, CloudCoffer is publishing this advisory to help organizations identify affected systems, assess their exposure, and take immediate defensive action.
IMPORTANTÂ The observed events represent attack attempts and do not, by themselves, confirm that exploitation was successful.
Key Facts
| Item | Assessment |
| Severity | Critical – CVSS 3.1 score: 9.8 |
| Weakness | CWE-502: Deserialization of Untrusted Data |
| Affected software | Apache Lucy – all versions |
| Attack requirement | Network access to the Lucy Remote SearchServer TCP port |
| Potential impact | Remote code execution or denial of service |
| Vendor fix | No patched version is planned; the project is retired |
Vulnerability Overview
Apache Lucy is a full-text search engine library designed primarily for dynamic programming languages such as Perl. It is not Apache HTTP Server or a conventional web server.
CVE-2026-61484 affects the remote search functionality provided by LucyX::Remote::SearchServer. When this function is enabled, Apache Lucy opens a separate TCP service that allows other applications to perform searches remotely.
The vulnerable service uses Perl’s Storable::thaw() function to deserialize data received from remote clients without first verifying whether the data is trusted. An unauthenticated attacker who can connect to the Lucy SearchServer may send a specially crafted serialized payload that could result in:
- Remote code execution
- Unauthorized system access
- Service crashes
- Denial of service
The vulnerability is classified as CWE-502, Deserialization of Untrusted Data, and carries a CVSS 3.1 score of 9.8, rated Critical. According to the Apache security advisory and the NIST National Vulnerability Database, all versions of Apache Lucy are affected.
Normal Apache Lucy Search Architecture
In a typical deployment, the website and Lucy SearchServer operate as separate service endpoints. A user connects to the web application over HTTPS, while the application communicates with Lucy through a custom TCP RPC protocol.
Figure 1. Normal Apache Lucy search architecture.
KEY POINTÂ Protecting the web application on TCP port 443 does not automatically protect the separate Lucy TCP service.
How the Attack Works
An attacker does not necessarily need to pass through the website or application. If the Lucy TCP service is exposed, the attacker can connect to it directly and submit a crafted binary payload.
Figure 2. Direct attack path to Lucy Remote SearchServer.
Lucy SearchServer first reads a four-byte payload length, then reads the specified amount of data and passes it directly to Storable::thaw(). The RPC action name is checked only after deserialization has occurred. Exploitation may therefore take place before the application reaches its normal business-logic validation.
Affected Environments
Although all Apache Lucy versions are considered affected, remote exploitation generally requires the following conditions:
- Apache Lucy is installed.
- LucyX::Remote::SearchServer is enabled.
- The SearchServer TCP port is reachable by the attacker.
- The port does not restrict source addresses or is directly exposed to the internet.
Systems that use Apache Lucy only for local indexing and searching, without enabling Remote SearchServer, do not expose the remote network entry point described in this vulnerability.
Why a Conventional WAF May Not Stop This Attack
A conventional web application firewall primarily inspects HTTP and HTTPS traffic, including HTTP methods, URLs, query parameters, headers, cookies, and structured bodies such as JSON, XML, or form data.
Apache Lucy SearchServer instead receives traffic in the following form:
| TCP connection + four-byte payload length + Perl Storable binary data |
If an attacker connects directly to the Lucy TCP service, the traffic may never pass through the WAF protecting the website’s HTTPS port. A WAF remains important for web application protection, but it should not be treated as the primary mitigation for CVE-2026-61484.
Recommended Actions
- Identify Apache Lucy Remote SearchServer Instances
Check servers for Perl- or Lucy-related listening services:
| ss -lntp | grep -Ei ‘perl|lucy’ lsof -nP -iTCP -sTCP:LISTEN | grep -Ei ‘perl|lucy’ |
Search source code and configuration files for:
| LucyX::Remote::SearchServer LucyX::Remote::SearchClient ClusterSearcher serve( serve_sock( |
Port 7890 appears in Apache Lucy documentation as an example only. The actual port depends on the application’s deployment configuration.
- Disable the Service When It Is Not Required
If remote search is unnecessary, stop LucyX::Remote::SearchServer and close its TCP port immediately. If the service is used only by applications on the same host, restrict it to the loopback interfaces:
| 127.0.0.1 ::1 |
Avoid listening on all interfaces:
| 0.0.0.0 :: |
- Restrict Access at the Network Layer
If Remote SearchServer must remain operational, use host firewalls, cloud security groups, network ACLs, or TCP load balancers to allow access only from explicitly authorized application servers.
| ALLOW: approved application server IP addresses -> Lucy TCP port DENY: all other sources -> Lucy TCP port |
Do not expose the service to 0.0.0.0/0 or ::/0. For connections across different networks, use a VPN, private network, or TCP proxy supporting mutual TLS authentication.
- Do Not Rely Only on Payload Keywords
The attack payload uses the binary Perl Storable format and may not contain obvious strings such as /bin/sh, curl, or wget. Likewise, strings such as _action, handshake, or top_docs may also appear in legitimate Lucy traffic.
Keyword-only blocking can therefore be bypassed and may also generate false positives. The most reliable control is to prevent untrusted sources from reaching Lucy SearchServer.
- Monitor for Suspicious Behavior
Security teams should monitor for:
- Lucy or Perl processes launching sh, bash, curl, wget, python, or nc.
- Executable files being created in /tmp or other temporary directories.
- Outbound connections from the Lucy service account to unknown IP addresses.
- Unusual or high-volume connections to the Lucy TCP port.
- Unexpected service crashes, restarts, or Perl Storable errors.
- New scheduled tasks, SSH keys, or persistence mechanisms created by the Lucy service account.
Organizations using CloudCoffer UTDS should review related alerts and raw traffic records to determine whether the detected activity reached an exposed SearchServer instance.
- Migrate Away from Apache Lucy
Apache Lucy was retired in June 2018, and its move to the Apache Attic was completed in November 2019. The project is no longer actively maintained, and no patched version will be released for CVE-2026-61484. Network filtering and service isolation should therefore be treated only as temporary risk-reduction measures. The long-term solution is to remove Apache Lucy and migrate to an actively maintained search engine or search library.
Conclusion
CVE-2026-61484 is a critical insecure deserialization vulnerability in Apache Lucy Remote SearchServer. An unauthenticated attacker who can reach the service’s TCP port may be able to submit malicious serialized data, leading to remote code execution or denial of service.
CloudCoffer UTDS has detected a high volume of attack attempts consistent with this vulnerability. Because the affected traffic may use a custom TCP protocol instead of HTTP or HTTPS, a conventional web application firewall alone cannot provide complete protection.
Organizations should immediately identify exposed Lucy SearchServer instances, close unnecessary ports, restrict access to trusted systems, investigate related security events, and migrate away from Apache Lucy as soon as possible.