Description
Lua v5.4.3 and above are affected by SEGV by type confusion in funcnamefromcode function in ldebug.c which can cause a local denial of service.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | lua5.4 | 5.4.4-1 | — |
| Debian 13 | lua5.4 | 5.4.4-1 | — |
| Debian 12 | lua5.4 | 5.4.4-1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | lua55 | 5.5.0~beta1-1.1 | openSUSE-SU-2025:15401-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | memcached | 1.6.27-3 | — |
| Azure Linux 3 | ntopng | 5.2.1-5 | — |
| Azure Linux 2 (CBL-Mariner) | lua | 5.4.3-3 | — |
Advisories 1
- openSUSE-SU-2025:15401-1 liblua5_5-5-5.5.0~beta1-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026