{"id":"CVE-2024-25178","details":"LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an out-of-bounds read in the stack-overflow handler in lj_state.c.","modified":"2026-08-18T17:52:09.507262Z","published":"2025-07-07T00:00:00Z","related":["SUSE-SU-2025:02886-1","SUSE-SU-2025:03378-1"],"database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/25xxx/CVE-2024-25178.json"},"references":[{"type":"WEB","url":"https://gist.github.com/pwnhacker0x18/423b4292f301ab274b42d5ed6e0b87d8"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/08/msg00022.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/25xxx/CVE-2024-25178.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25178"},{"type":"REPORT","url":"https://github.com/LuaJIT/LuaJIT/issues/1152"},{"type":"FIX","url":"https://github.com/LuaJIT/LuaJIT/commit/defe61a56751a0db5f00ff3ab7b8f45436ba74c8"},{"type":"FIX","url":"https://github.com/openresty/luajit2/commit/defe61a56751a0db5f00ff3ab7b8f45436ba74c8"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/luajit/luajit","events":[{"introduced":"0"},{"fixed":"2090842410e0ba6f81fad310a77bf5432488249a"},{"fixed":"defe61a56751a0db5f00ff3ab7b8f45436ba74c8"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.1"}],"source":["DESCRIPTION","REFERENCES"]}},{"type":"GIT","repo":"https://github.com/openresty/luajit2","events":[{"introduced":"0"},{"fixed":"15f58c9648ee40a3fb6617e22e2f3fdff80d66b8"},{"fixed":"defe61a56751a0db5f00ff3ab7b8f45436ba74c8"}],"database_specific":{"extracted_events":[{"introduced":"luajit2"},{"fixed":"v2.1-20240314"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["v2.0.ROLLING","v2.1.0-beta3","v2.0.5","v2.1.0-beta2","v2.1.0-beta1","v2.0.4","v2.0.3","v2.0.2","v2.0.1-fixed","v2.0.1","v2.0.0-rc3","v2.0.0","v2.0.0-rc2","v2.0.0-rc1","v2.0.0-beta11","v2.0.0-beta10","v2.0.0-beta9","v2.0.0-beta8-fixed","v2.0.0-beta8","v2.0.0-beta7","v2.0.0-beta6","v2.0.0-beta5","v2.0.0-beta4","v2.0.0-beta3","v2.0.0-beta2-hotfix2","v2.0.0-beta2","v2.0.0-beta1","v2.1-20210510","v2.1-20230410","v2.1-20231117","v2.1-20231021","v2.1-20231006","v2.1-20230911","v2.1-20230119","v2.1-20220915","v2.1-20220411","v2.1-20220310","v2.1-20220309","v2.1-20220111","v2.1-20211210","v2.1-20201229","v2.1-20201027","v2.1-20201012-2","v2.1-20201008","v2.1-20201002","v2.1-20201001","v2.1-20200102","v2.1-20190912","v2.1-20190626","v2.1-20190530","v2.1-20190507","v2.1-20190329","v2.1-20190302","v2.1-20190228","v2.1-20190221","v2.1-20190131","v2.1-20190130","v2.1-20190115","v2.1-20181029","v2.1-20180420","v2.1-20180419","v2.1-20171103","v2.1-20170925","v2.1-20170808","v2.1-20170517","v2.1-20170513","v2.1-20170405","v2.1-20161104","v2.1-20160517","v2.1-20160516","v2.1-20160514","v2.1-20160108","v2.1-20151219","v2.1-20151205","v2.1-20151028","v2.1-20150622","v2.1-20150331","v2.1-20150223","v2.1-20150218","v2.1-20150120","v2.1-20141128","v2.1-20141115","v2.1-20141024","v2.1-20140920","v2.1-20140805","v2.1-20140731","v2.1-20140707","v2.1-20140703","v2.1-20140627","v2.1-20140607","v2.1-20140531","v2.1-20140529","v2.1-20140520","v2.1-20140515-2","v2.1-20140515","v2.1-20140513","v2.1-20140423","v2.1-20140419","v2.1-20140411","v2.1-20140403","v2.1-20140401","v2.1-20140330","v2.1-20140325","v2.1-20140313","v2.1-20140305","v2.1-20140304","v2.1-20140228","v2.1-20140207","v2.1-20140204","v2.1-20140129","v2.1-20140101","v2.1-20131219","v2.1-20131211","v2.1-12032013","v2.1-11252013","v2.1-11182013"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-25178.json","vanir_signatures_modified":"2026-08-18T17:52:09Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/openresty/luajit2/commit/defe61a56751a0db5f00ff3ab7b8f45436ba74c8","target":{"file":"src/lj_err.h"},"deprecated":false,"digest":{"line_hashes":["54050595518120967622896392845927167681","15070245444666457301793099561169003833","320681905010042593851437360386241621384","314491342751211321455725763182361569391"],"threshold":0.9},"id":"CVE-2024-25178-027b122f","signature_type":"Line"},{"digest":{"line_hashes":["175265014896106002403946613573786699968","197399067499152755998847627260198159960","116940952920393853474400420530029569999","17195866420894312641159619656422570504","270305923755407770796822705000165410927","191473466209037161331382735023326294999","103866882458321787333621118024924364456","286528071522097903130088633731689501022","205418231937864698460410781796669678690","210835692443088131349037926938450397004","175274725561173045038395520611593296651","279102159455966962128442334341789984528","74967209383444881529968484594066922671"],"threshold":0.9},"id":"CVE-2024-25178-088621e0","signature_type":"Line","signature_version":"v1","source":"https://github.com/openresty/luajit2/commit/defe61a56751a0db5f00ff3ab7b8f45436ba74c8","target":{"file":"src/lj_err.c"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["277024855705172535011344108957442779773","193341672357919148145521472639704451384","239817343184206947973547231590700306149","271657220955694740216157348712103466851","151015622724334242152379780113683322815","208884359861957586290619840674240379838","137851220125126039734150454611207961730","249763080357394971460150877036173573539","108865677583523157312376737950178335334","90513587949215906042301769096487702116","201372420145530435073427262751136916973","140081803099111383703159557805636865972","26833242892596005318803701951642670227","236427332506692914507654054535035984418","337510366572983224077165314320187776736","277971212153318530724414602621330352166","177298771810510089332421618840280769209","277010972630919169706352803208896369876","92095899878429511972813154301841668788","127592519123815158622255260146181694635","76157443837616571298013795723806884545"],"threshold":0.9},"id":"CVE-2024-25178-16d06e12","signature_type":"Line","signature_version":"v1","source":"https://github.com/luajit/luajit/commit/defe61a56751a0db5f00ff3ab7b8f45436ba74c8","target":{"file":"src/lj_state.c"}},{"digest":{"line_hashes":["175265014896106002403946613573786699968","197399067499152755998847627260198159960","116940952920393853474400420530029569999","17195866420894312641159619656422570504","270305923755407770796822705000165410927","191473466209037161331382735023326294999","103866882458321787333621118024924364456","286528071522097903130088633731689501022","205418231937864698460410781796669678690","210835692443088131349037926938450397004","175274725561173045038395520611593296651","279102159455966962128442334341789984528","74967209383444881529968484594066922671"],"threshold":0.9},"id":"CVE-2024-25178-287d868c","signature_type":"Line","signature_version":"v1","source":"https://github.com/luajit/luajit/commit/defe61a56751a0db5f00ff3ab7b8f45436ba74c8","target":{"file":"src/lj_err.c"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/luajit/luajit/commit/defe61a56751a0db5f00ff3ab7b8f45436ba74c8","target":{"file":"src/lj_debug.c","function":"debug_framepc"},"deprecated":false,"digest":{"function_hash":"50067456856387634292401281977494003867","length":1548},"id":"CVE-2024-25178-4bde8851","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/openresty/luajit2/commit/defe61a56751a0db5f00ff3ab7b8f45436ba74c8","target":{"file":"src/lj_debug.c"},"deprecated":false,"digest":{"line_hashes":["134549044816835016606906774647420951103","170817815714175202946605932544776752531","218582723080459621474861288584455163421","327053795116861641334942614506163330548"],"threshold":0.9},"id":"CVE-2024-25178-6ee6d6d4"},{"source":"https://github.com/luajit/luajit/commit/defe61a56751a0db5f00ff3ab7b8f45436ba74c8","target":{"file":"src/lj_state.c","function":"lj_state_growstack"},"deprecated":false,"digest":{"function_hash":"250095970941643160031860255363092946226","length":536},"id":"CVE-2024-25178-754e033d","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/openresty/luajit2/commit/defe61a56751a0db5f00ff3ab7b8f45436ba74c8","target":{"file":"src/lj_state.c"},"deprecated":false,"digest":{"line_hashes":["277024855705172535011344108957442779773","193341672357919148145521472639704451384","239817343184206947973547231590700306149","271657220955694740216157348712103466851","151015622724334242152379780113683322815","208884359861957586290619840674240379838","137851220125126039734150454611207961730","249763080357394971460150877036173573539","108865677583523157312376737950178335334","90513587949215906042301769096487702116","201372420145530435073427262751136916973","140081803099111383703159557805636865972","26833242892596005318803701951642670227","236427332506692914507654054535035984418","337510366572983224077165314320187776736","277971212153318530724414602621330352166","177298771810510089332421618840280769209","277010972630919169706352803208896369876","92095899878429511972813154301841668788","127592519123815158622255260146181694635","76157443837616571298013795723806884545"],"threshold":0.9},"id":"CVE-2024-25178-7caeb2df","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/luajit/luajit/commit/defe61a56751a0db5f00ff3ab7b8f45436ba74c8","target":{"file":"src/lj_err.h"},"deprecated":false,"digest":{"line_hashes":["54050595518120967622896392845927167681","15070245444666457301793099561169003833","320681905010042593851437360386241621384","314491342751211321455725763182361569391"],"threshold":0.9},"id":"CVE-2024-25178-965900fb","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2024-25178-97ecb279","signature_type":"Function","signature_version":"v1","source":"https://github.com/openresty/luajit2/commit/defe61a56751a0db5f00ff3ab7b8f45436ba74c8","target":{"function":"lj_err_mem","file":"src/lj_err.c"},"deprecated":false,"digest":{"function_hash":"152599931405697861393702385850197640506","length":293}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/openresty/luajit2/commit/defe61a56751a0db5f00ff3ab7b8f45436ba74c8","target":{"file":"src/lj_state.c","function":"lj_state_growstack"},"deprecated":false,"digest":{"function_hash":"250095970941643160031860255363092946226","length":536},"id":"CVE-2024-25178-a53d421c"},{"id":"CVE-2024-25178-ac20fe0e","signature_type":"Function","signature_version":"v1","source":"https://github.com/openresty/luajit2/commit/defe61a56751a0db5f00ff3ab7b8f45436ba74c8","target":{"file":"src/lj_err.c","function":"lj_err_run"},"deprecated":false,"digest":{"function_hash":"74590149630808721859909653481560825931","length":552}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/openresty/luajit2/commit/defe61a56751a0db5f00ff3ab7b8f45436ba74c8","target":{"file":"src/lj_debug.c","function":"debug_framepc"},"deprecated":false,"digest":{"function_hash":"50067456856387634292401281977494003867","length":1548},"id":"CVE-2024-25178-c4cdde9f"},{"target":{"file":"src/lj_err.c","function":"lj_err_run"},"deprecated":false,"digest":{"function_hash":"74590149630808721859909653481560825931","length":552},"id":"CVE-2024-25178-defbf192","signature_type":"Function","signature_version":"v1","source":"https://github.com/luajit/luajit/commit/defe61a56751a0db5f00ff3ab7b8f45436ba74c8"},{"source":"https://github.com/luajit/luajit/commit/defe61a56751a0db5f00ff3ab7b8f45436ba74c8","target":{"file":"src/lj_debug.c"},"deprecated":false,"digest":{"line_hashes":["134549044816835016606906774647420951103","170817815714175202946605932544776752531","218582723080459621474861288584455163421","327053795116861641334942614506163330548"],"threshold":0.9},"id":"CVE-2024-25178-f0fb33fb","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"152599931405697861393702385850197640506","length":293},"id":"CVE-2024-25178-fcbfadab","signature_type":"Function","signature_version":"v1","source":"https://github.com/luajit/luajit/commit/defe61a56751a0db5f00ff3ab7b8f45436ba74c8","target":{"file":"src/lj_err.c","function":"lj_err_mem"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"}]}