GCVE - cpe:2.3:a:lua:lua:5.4.0:-:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:lua:lua:5.4.0:-:*:*:*:*:*:*

part: a version: 5.4.0 update: -

Vendor	Lua (`5d64284d-58d7-55d2-8192-84bb490cef71`)
Product	Lua (`6cff8272-4f1a-522a-a6b7-be7cfb9d18e1`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/lua/lua`	purl2cpe	2026-06-01 10:16:42.665668
`pkg:rpm/centos/lua`	purl2cpe	2026-06-01 10:16:42.665669
`pkg:rpm/fedora/lua`	purl2cpe	2026-06-01 10:16:42.665671

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2020-24371`	vulnerable	2026-06-08 05:22:32.906431	Details available lgc.c in Lua 5.4.0 mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage. Published: 2020-08-17T16:06:14.000Z Updated: 2024-08-04T15:12:08.966Z Open on db.gcve.eu Reference links https://github.com/lua/lua/commit/a6da1472c0c5e05ff249325f979531ad51533110 https://www.lua.org/bugs.html#5.4.0-10	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-24370`	vulnerable	2026-06-08 05:22:32.903830	Details available ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31). Published: 2020-08-17T00:00:00.000Z Updated: 2024-08-04T15:12:08.645Z Open on db.gcve.eu Reference links http://lua-users.org/lists/lua-l/2020-07/msg00324.html https://github.com/lua/lua/commit/a585eae6e7ada1ca9271607a4f48dfb17868ab7b https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXYMCIUNGK26VHAYHGP5LPW56G2KWOHQ/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E6KONNG6UEI3FMEOY67NDZC32NBGBI44/ https://lists.debian.org/debian-lts-announce/2020/09/msg00019.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-24369`	vulnerable	2026-06-08 05:22:32.887611	Details available ldebug.c in Lua 5.4.0 attempts to access debug information via the line hook of a stripped function, leading to a NULL pointer dereference. Published: 2020-08-17T16:06:42.000Z Updated: 2024-08-04T15:12:08.718Z Open on db.gcve.eu Reference links https://www.lua.org/bugs.html#5.4.0-12 https://github.com/lua/lua/commit/ae5b5ba529753c7a653901ffc29b5ea24c3fdf3a	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-15888`	vulnerable	2026-06-08 05:19:27.096020	Details available Lua through 5.4.0 mishandles the interaction between stack resizes and garbage collection, leading to a heap-based buffer overflow, heap-based buffer over-read, or use-after-free. Published: 2020-07-21T21:36:02.000Z Updated: 2024-08-04T13:30:23.046Z Open on db.gcve.eu Reference links https://github.com/lua/lua/commit/eb41999461b6f428186c55abd95f4ce1a76217d5 https://github.com/lua/lua/commit/6298903e35217ab69c279056f925fb72900ce0b7 http://lua-users.org/lists/lua-l/2020-07/msg00053.html http://lua-users.org/lists/lua-l/2020-07/msg00054.html http://lua-users.org/lists/lua-l/2020-07/msg00071.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Lua 5.4.0

Notes

PURL mappings

Vulnerability references

Contribute