CVE-2026-61485: Apache Lucy: Freezer/InStream deserialization bomb - unbounded allocation reading an index

<p>Posted by Piotr Karwasz on Aug 05</p>Severity: moderate <br /> <br /> Affected versions:<br /> <br /> - Apache Lucy (Lucy): all versions<br /> <br /> Description:<br /> <br /> ** UNSUPPORTED WHEN ASSIGNED ** Memory Allocation with Excessive Size Value vulnerability in Apache Lucy.<br /> <br /> This issue affects Apache Lucy: all versions.<br /> <br /> As this project is retired, we do not plan