CVE-2020-15888

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-15888
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15888.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-15888
Aliases
Downstream
Related
Published
2020-07-21T22:15:12.090Z
Modified
2026-07-08T20:30:32.483097Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Lua through 5.4.0 mishandles the interaction between stack resizes and garbage collection, leading to a heap-based buffer overflow, heap-based buffer over-read, or use-after-free.

References

Affected packages

Git / github.com/lua/lua

Affected ranges

Type
GIT
Repo
https://github.com/lua/lua
Events
Introduced
c33b1728aeb7dfeec4013562660e07d32697aa6b
Last affected
c33b1728aeb7dfeec4013562660e07d32697aa6b
Fixed
6298903e35217ab69c279056f925fb72900ce0b7
Fixed
eb41999461b6f428186c55abd95f4ce1a76217d5
Database specific 
{
    "extracted_events": [
        {
            "introduced": "5.4.0-NA"
        },
        {
            "last_affected": "5.4.0-NA"
        }
    ],
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:lua:lua:5.4.0:-:*:*:*:*:*:*"
}

Affected versions

5.*
5.4.0-NA
v5.*
v5.4.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15888.json"
vanir_signatures_modified 
"2026-07-08T20:30:32Z"
vanir_signatures 
[
    {
        "digest": {
            "line_hashes": [
                "130386227620455140858146550303983838314",
                "53530003333973101310414257650565813173",
                "28974977378586334153185605006886505404",
                "136918642051494489778486467500759107040",
                "328159481941225625655491816177627870490",
                "186359140399090271729245150160144907014",
                "307933728407298461961473498693164051109",
                "18570838454356378009077054400105344104",
                "276237006808805615248351817130758371705",
                "300432671829517395228355465263980445269"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2020-15888-0e454c8a",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/lua/lua/commit/eb41999461b6f428186c55abd95f4ce1a76217d5",
        "signature_type": "Line",
        "target": {
            "file": "ldo.h"
        }
    },
    {
        "digest": {
            "line_hashes": [
                "105135762939629227699804883912263599423",
                "247486404441361576507022499946075620572",
                "118496697812361212017269119553004280254",
                "106424969772443140265390255039807120079",
                "37540638878154083333708483624367283972",
                "169294646749318997068984273064754916339",
                "93724494676492250101028184475526945103",
                "319218437690893170572963497387866274074"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2020-15888-1356813b",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/lua/lua/commit/eb41999461b6f428186c55abd95f4ce1a76217d5",
        "signature_type": "Line",
        "target": {
            "file": "ltm.c"
        }
    },
    {
        "digest": {
            "function_hash": "180637455239788581404342292874638595161",
            "length": 337.0
        },
        "id": "CVE-2020-15888-2d75f329",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/lua/lua/commit/6298903e35217ab69c279056f925fb72900ce0b7",
        "signature_type": "Function",
        "target": {
            "function": "luaD_shrinkstack",
            "file": "ldo.c"
        }
    },
    {
        "digest": {
            "line_hashes": [
                "231483642368277910488853698800913036458",
                "262414955084817609584224181936361745183",
                "49450719460278863998359163241966262560",
                "11043102250839843449606126582202505977",
                "184449424765427880990090857574888028249",
                "201550099967893807412619658723682673252",
                "94801572708305704545442678458010346836",
                "163722850367216824107617962342832113473"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2020-15888-3952a7cf",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/lua/lua/commit/6298903e35217ab69c279056f925fb72900ce0b7",
        "signature_type": "Line",
        "target": {
            "file": "ldo.c"
        }
    },
    {
        "digest": {
            "line_hashes": [
                "20768315219636672424456947595552143535",
                "312418570843409483009923973890277641613",
                "253482659380919832210443693850598886815",
                "120018164947122116008547476865049921541"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2020-15888-9f89c533",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/lua/lua/commit/eb41999461b6f428186c55abd95f4ce1a76217d5",
        "signature_type": "Line",
        "target": {
            "file": "lvm.c"
        }
    }
]