GCVE - cpe:2.3:a:lua:lua:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:lua:lua:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Lua (`5d64284d-58d7-55d2-8192-84bb490cef71`)
Product	Lua (`6cff8272-4f1a-522a-a6b7-be7cfb9d18e1`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/lua/lua`	purl2cpe	2026-06-01 10:16:42.650577
`pkg:rpm/centos/lua`	purl2cpe	2026-06-01 10:16:42.650579
`pkg:rpm/fedora/lua`	purl2cpe	2026-06-01 10:16:42.650580

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2022-33099`	vulnerable	2026-06-08 05:44:46.219593	Details available An issue in the component luaG_runerror of Lua v5.4.4 and below leads to a heap-buffer overflow when a recursive error occurs. Published: 2022-07-01T11:26:38.000Z Updated: 2024-08-03T08:01:20.153Z Open on db.gcve.eu Reference links https://github.com/lua/lua/commit/42d40581dd919fb134c07027ca1ce0844c670daf https://lua-users.org/lists/lua-l/2022-05/msg00035.html https://lua-users.org/lists/lua-l/2022-05/msg00042.html https://lua-users.org/lists/lua-l/2022-05/msg00073.html https://www.lua.org/bugs.html#Lua-stack%20overflow%20when%20C%20stack%20overflows%20while%20handling%20an%20error:~:text=Lua-stack%20overflow%20when%20C%20stack%20overflows%20while%20handling%20an%20error	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-28805`	vulnerable	2026-06-08 05:42:45.827719	Details available singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code. Published: 2022-04-08T00:00:00.000Z Updated: 2024-08-03T06:03:53.085Z Open on db.gcve.eu Reference links https://lua-users.org/lists/lua-l/2022-02/msg00001.html https://lua-users.org/lists/lua-l/2022-02/msg00070.html https://lua-users.org/lists/lua-l/2022-04/msg00009.html https://github.com/lua/lua/commit/1f3c6f4534c6411313361697d98d1145a1f030fa https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RJNJ66IFDUKWJJZXHGOLRGIA3HWWC36R/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-45985`	vulnerable	2026-06-08 05:36:49.645828	Details available In Lua 5.4.3, an erroneous finalizer called during a tail call leads to a heap-based buffer over-read. Published: 2023-04-10T00:00:00.000Z Updated: 2025-02-12T16:02:20.735Z Open on db.gcve.eu Reference links https://www.lua.org/bugs.html#5.4.3-11 https://github.com/lua/lua/commit/cf613cdc6fa367257fc61c256f63d917350858b5 http://lua-users.org/lists/lua-l/2021-12/msg00019.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-44964`	vulnerable	2026-06-08 05:36:47.651653	Details available Use after free in garbage collector and finalizer of lgc.c in Lua interpreter 5.4.0~5.4.3 allows attackers to perform Sandbox Escape via a crafted script file. Published: 2022-03-14T14:24:51.000Z Updated: 2024-08-04T04:32:13.466Z Open on db.gcve.eu Reference links http://lua-users.org/lists/lua-l/2021-11/msg00186.html http://lua-users.org/lists/lua-l/2021-12/msg00007.html http://lua-users.org/lists/lua-l/2021-12/msg00015.html http://lua-users.org/lists/lua-l/2021-12/msg00030.html https://github.com/Lua-Project/lua-5.4.4-sandbox-escape-with-new-vulnerability	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-43519`	vulnerable	2026-06-08 05:36:43.477025	Details available Stack overflow in lua_resume of ldo.c in Lua Interpreter 5.1.0~5.4.4 allows attackers to perform a Denial of Service via a crafted script file. Published: 2021-11-09T12:26:22.000Z Updated: 2024-08-04T03:55:29.081Z Open on db.gcve.eu Reference links http://lua-users.org/lists/lua-l/2021-10/msg00123.html http://lua-users.org/lists/lua-l/2021-11/msg00015.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C7XHFYHGSZKL53VCLSJSAJ6VMFGAIXKO/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P3EMGAQ5Y6GXJLY4K5DUOOEQT4MZ4J4F/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-32921`	not_vulnerable	2026-06-08 05:32:08.195678	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-15945`	vulnerable	2026-06-08 05:19:27.222831	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Lua

Notes

PURL mappings

Vulnerability references

Contribute