{"id":"CVE-2024-25177","details":"LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an unsinking of IR_FSTORE for NULL metatable, which leads to Denial of Service (DoS).","modified":"2026-08-18T17:52:08.981865Z","published":"2025-07-07T00:00:00Z","related":["SUSE-SU-2025:02886-1","SUSE-SU-2025:03378-1"],"database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/25xxx/CVE-2024-25177.json"},"references":[{"type":"WEB","url":"https://gist.github.com/pwnhacker0x18/a73f560d79f2c3d4011d6c5a2676f04a"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/08/msg00022.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/25xxx/CVE-2024-25177.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25177"},{"type":"REPORT","url":"https://github.com/LuaJIT/LuaJIT/issues/1147"},{"type":"FIX","url":"https://github.com/LuaJIT/LuaJIT/commit/85b4fed0b0353dd78c8c875c2f562d522a2b310f"},{"type":"FIX","url":"https://github.com/openresty/luajit2/commit/85b4fed0b0353dd78c8c875c2f562d522a2b310f"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/luajit/luajit","events":[{"introduced":"0"},{"fixed":"2090842410e0ba6f81fad310a77bf5432488249a"},{"fixed":"85b4fed0b0353dd78c8c875c2f562d522a2b310f"}],"database_specific":{"source":["DESCRIPTION","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"2.1"}]}},{"type":"GIT","repo":"https://github.com/openresty/luajit2","events":[{"introduced":"0"},{"fixed":"15f58c9648ee40a3fb6617e22e2f3fdff80d66b8"},{"fixed":"85b4fed0b0353dd78c8c875c2f562d522a2b310f"}],"database_specific":{"extracted_events":[{"introduced":"luajit2"},{"fixed":"v2.1-20240314"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["v2.0.ROLLING","v2.1.0-beta3","v2.0.5","v2.1.0-beta2","v2.1.0-beta1","v2.0.4","v2.0.3","v2.0.2","v2.0.1-fixed","v2.0.1","v2.0.0-rc3","v2.0.0","v2.0.0-rc2","v2.0.0-rc1","v2.0.0-beta11","v2.0.0-beta10","v2.0.0-beta9","v2.0.0-beta8-fixed","v2.0.0-beta8","v2.0.0-beta7","v2.0.0-beta6","v2.0.0-beta5","v2.0.0-beta4","v2.0.0-beta3","v2.0.0-beta2-hotfix2","v2.0.0-beta2","v2.0.0-beta1","v2.1-20210510","v2.1-20230410","v2.1-20231117","v2.1-20231021","v2.1-20231006","v2.1-20230911","v2.1-20230119","v2.1-20220915","v2.1-20220411","v2.1-20220310","v2.1-20220309","v2.1-20220111","v2.1-20211210","v2.1-20201229","v2.1-20201027","v2.1-20201012-2","v2.1-20201008","v2.1-20201002","v2.1-20201001","v2.1-20200102","v2.1-20190912","v2.1-20190626","v2.1-20190530","v2.1-20190507","v2.1-20190329","v2.1-20190302","v2.1-20190228","v2.1-20190221","v2.1-20190131","v2.1-20190130","v2.1-20190115","v2.1-20181029","v2.1-20180420","v2.1-20180419","v2.1-20171103","v2.1-20170925","v2.1-20170808","v2.1-20170517","v2.1-20170513","v2.1-20170405","v2.1-20161104","v2.1-20160517","v2.1-20160516","v2.1-20160514","v2.1-20160108","v2.1-20151219","v2.1-20151205","v2.1-20151028","v2.1-20150622","v2.1-20150331","v2.1-20150223","v2.1-20150218","v2.1-20150120","v2.1-20141128","v2.1-20141115","v2.1-20141024","v2.1-20140920","v2.1-20140805","v2.1-20140731","v2.1-20140707","v2.1-20140703","v2.1-20140627","v2.1-20140607","v2.1-20140531","v2.1-20140529","v2.1-20140520","v2.1-20140515-2","v2.1-20140515","v2.1-20140513","v2.1-20140423","v2.1-20140419","v2.1-20140411","v2.1-20140403","v2.1-20140401","v2.1-20140330","v2.1-20140325","v2.1-20140313","v2.1-20140305","v2.1-20140304","v2.1-20140228","v2.1-20140207","v2.1-20140204","v2.1-20140129","v2.1-20140101","v2.1-20131219","v2.1-20131211","v2.1-12032013","v2.1-11252013","v2.1-11182013"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-25177.json","vanir_signatures_modified":"2026-08-18T17:52:08Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"203087968805785380088111885039723137363","length":570},"id":"CVE-2024-25177-0b21938c","signature_type":"Function","signature_version":"v1","source":"https://github.com/luajit/luajit/commit/85b4fed0b0353dd78c8c875c2f562d522a2b310f","target":{"file":"src/lj_snap.c","function":"snap_replay_const"}},{"signature_version":"v1","source":"https://github.com/openresty/luajit2/commit/85b4fed0b0353dd78c8c875c2f562d522a2b310f","target":{"file":"src/lj_snap.c"},"deprecated":false,"digest":{"line_hashes":["328851366615205159600879125988537784760","187708736421711303964457164439587907200","207873470814917637525689825456575210292","327582682703369524527697500124813874868","97083308229016597306128497472693802223","95806262639384273180919947489632886570","130085288147700083953557008386072178626","58043924142223039666946178628332009909","271509107339337137925848792752905808826"],"threshold":0.9},"id":"CVE-2024-25177-393b0fe7","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/luajit/luajit/commit/85b4fed0b0353dd78c8c875c2f562d522a2b310f","target":{"file":"src/lj_snap.c","function":"snap_unsink"},"deprecated":false,"digest":{"function_hash":"34102034867156844221458460469079786892","length":3580},"id":"CVE-2024-25177-3c7a3aa2","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["328851366615205159600879125988537784760","187708736421711303964457164439587907200","207873470814917637525689825456575210292","327582682703369524527697500124813874868","97083308229016597306128497472693802223","95806262639384273180919947489632886570","130085288147700083953557008386072178626","58043924142223039666946178628332009909","271509107339337137925848792752905808826"],"threshold":0.9},"id":"CVE-2024-25177-7a4eb3ab","signature_type":"Line","signature_version":"v1","source":"https://github.com/luajit/luajit/commit/85b4fed0b0353dd78c8c875c2f562d522a2b310f","target":{"file":"src/lj_snap.c"}},{"id":"CVE-2024-25177-a9aefc31","signature_type":"Function","signature_version":"v1","source":"https://github.com/openresty/luajit2/commit/85b4fed0b0353dd78c8c875c2f562d522a2b310f","target":{"function":"snap_unsink","file":"src/lj_snap.c"},"deprecated":false,"digest":{"function_hash":"34102034867156844221458460469079786892","length":3580}},{"digest":{"function_hash":"203087968805785380088111885039723137363","length":570},"id":"CVE-2024-25177-d016918a","signature_type":"Function","signature_version":"v1","source":"https://github.com/openresty/luajit2/commit/85b4fed0b0353dd78c8c875c2f562d522a2b310f","target":{"file":"src/lj_snap.c","function":"snap_replay_const"},"deprecated":false}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}