Security Advisories (4)
CVE-2026-61483 (2026-08-05)

Apache Lucy: QueryParser unbounded recursion on deeply-nested query -> C-stack-overflow DoS ** UNSUPPORTED WHEN ASSIGNED ** Uncontrolled Recursion vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVE-2026-61485 (2026-08-05)

Apache Lucy: Freezer/InStream deserialization bomb - unbounded allocation reading an index ** UNSUPPORTED WHEN ASSIGNED ** Uncontrolled Recursion vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVE-2026-61486 (2026-08-05)

Apache Lucy: stack-buffer-overflow in JSON parser error reporter on malformed input ** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVE-2026-61484 (2026-08-05)

Apache Lucy: LucyX::Remote::SearchServer unauthenticated remote Storable::thaw -> RCE/DoS ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

NAME

Lucy::Index::PostingList - Term-Document pairings.

SYNOPSIS

my $posting_list_reader 
    = $seg_reader->obtain("Lucy::Index::PostingListReader");
my $posting_list = $posting_list_reader->posting_list( 
    field => 'content',
    term  => 'foo',
);
while ( my $doc_id = $posting_list->next ) {
    say "Matching doc id: $doc_id";
}

DESCRIPTION

PostingList is an iterator which supplies a list of document ids that match a given term.

See Lucy::Docs::IRTheory for definitions of "posting" and "posting list".

ABSTRACT METHODS

next()

Proceed to the next doc id.

Returns: A positive doc id, or 0 once the iterator is exhausted.

get_doc_id()

Return the current doc id. Valid only after a successful call to next() or advance() and must not be called otherwise.

get_doc_freq()

Return the number of documents that the PostingList contains. (This number will include any documents which have been marked as deleted but not yet purged.)

seek(target)

Prepare the PostingList object to iterate over matches for documents that match target.

  • target - The term to match. If undef, the iterator will be empty.

METHODS

advance(target)

Advance the iterator to the first doc id greater than or equal to target. The default implementation simply calls next() over and over, but subclasses have the option of doing something more efficient.

  • target - A positive doc id, which must be greater than the current doc id once the iterator has been initialized.

Returns: A positive doc id, or 0 once the iterator is exhausted.

INHERITANCE

Lucy::Index::PostingList isa Lucy::Search::Matcher isa Clownfish::Obj.