CVE-2021-44647
Lua 5.4.4 and 5.4.2 are affected by SEGV by type confusion in funcnamefromcode function in ldebug...
Lua v5.4.3 and above are affected by SEGV by type confusion in funcnamefromcode function in ldebug.c which can cause a local denial of service.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Lua v5.4.3 and above are affected by SEGV by type confusion in funcnamefromcode function in ldebug.c which can cause a local denial of service.
- Record
CVE-2021-44647- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-843
- Updated
- 2026-11-02
CVE List No score
Lua v5.4.3 and above are affected by SEGV by type confusion in funcnamefromcode function in ldebug.c which can cause a local denial of service.
- Record
CVE-2021-44647- Updated
- 2026-11-02
EUVDEUVD-2021-31468 No score
Lua v5.4.3 and above are affected by SEGV by type confusion in funcnamefromcode function in ldebug.c which can cause a local denial of service.
- Record
EUVD-2021-31468- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wvx9-9phh-9j3h
Lua 5.4.4 and 5.4.2 are affected by SEGV by type confusion in funcnamefromcode function in ldebug...
Lua 5.4.4 and 5.4.2 are affected by SEGV by type confusion in funcnamefromcode function in ldebug.c which can cause a local denial of service.
- Record
GHSA-wvx9-9phh-9j3h- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-843
- Updated
- 2026-11-02
OSVAZL-41327
CVE-2021-44647 affecting package memcached for versions less than 1.6.27-3
Lua v5.4.3 and above are affected by SEGV by type confusion in funcnamefromcode function in ldebug.c which can cause a local denial of service.
- Record
AZL-41327- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-05
OSVAZL-41797
CVE-2021-44647 affecting package ntopng for versions less than 5.2.1-5
Lua v5.4.3 and above are affected by SEGV by type confusion in funcnamefromcode function in ldebug.c which can cause a local denial of service.
- Record
AZL-41797- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-05
Show 10 moreShow less
OSVAZL-9317
CVE-2021-44647 affecting package lua for versions less than 5.4.3-3
Lua v5.4.3 and above are affected by SEGV by type confusion in funcnamefromcode function in ldebug.c which can cause a local denial of service.
- Record
AZL-9317- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBELL-CVE-2021-44647
CVE-2021-44647 does not affect BellSoft software
- Record
BELL-CVE-2021-44647- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
Lua v5.4.3 and above are affected by SEGV by type confusion in funcnamefromcode function in ldebug.c which can cause a local denial of service.
- Record
CVE-2021-44647- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-44647
Lua v5.4.3 and above are affected by SEGV by type confusion in funcnamefromcode function in ldebug.c which can cause a local denial of service.
- Record
DEBIAN-CVE-2021-44647- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVJLSEC-2026-557
Lua v5.4.3 and above are affected by SEGV by type confusion in funcnamefromcode function in ldebug.c which can cause a local denial of service.
- Record
JLSEC-2026-557- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
OSVOESA-2022-1632
lua security update
Lua is a powerful, efficient, lightweight, embeddable scripting language. It supports procedural programming, object-oriented programming, functional programming, data-driven programming, and data description.
Security Fix(es):
singlevar in lparser.c in Lua through 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code.(CVE-2022-28805)
Lua 5.4.4 and 5.4.2 are affected by SEGV by type confusion in funcnamefromcode function in ldebug.c which can cause a local denial of service.(CVE-2021-44647)
- Record
OESA-2022-1632- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-44647
Lua v5.4.3 and above are affected by SEGV by type confusion in funcnamefromcode function in ldebug.c which can cause a local denial of service.
- Record
UBUNTU-CVE-2021-44647- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBIT-lua-2021-44647 No score
Lua v5.4.3 and above are affected by SEGV by type confusion in funcnamefromcode function in ldebug.c which can cause a local denial of service.
- Record
BIT-lua-2021-44647- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12156-1 No score
liblua5_4-5-32bit-5.4.4-4.1 on GA media
These are all security issues fixed in the liblua5_4-5-32bit-5.4.4-4.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12156-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15401-1 No score
liblua5_5-5-5.5.0~beta1-1.1 on GA media
These are all security issues fixed in the liblua5_5-5-5.5.0~beta1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15401-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
memcachedAzure Linux:3 |
before 1.6.27-3 | 1.6.27-3 |
ntopngAzure Linux:3 |
before 5.2.1-5 | 5.2.1-5 |
luaAzure Linux:2 |
before 5.4.3-3 | 5.4.3-3 |
luaBitnami |
5.4.3 up to 5.4.4 | 5.4.4 |
lua5.4Debian:12 |
before 5.4.4-1 | 5.4.4-1 |
lua5.4Debian:13 |
before 5.4.4-1 | 5.4.4-1 |
lua5.4Debian:14 |
before 5.4.4-1 | 5.4.4-1 |
Lua_jllJulia |
5.4.3+0 up to 5.4.4+0 | 5.4.4+0 |
luaopenEuler:22.03-LTS From an advisory covering 2 CVEs |
before 5.4.3-6.oe2203 | 5.4.3-6.oe2203 |
lua55openSUSE:Tumbleweed From an advisory covering 9 CVEs |
before 5.5.0~beta1-1.1 | 5.5.0~beta1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-44647 is a medium vulnerability (CVSS 5.5) in Lua, published January 11, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 39th percentile. Fixed in memcached 1.6.27-3.
References
lua-users.org/lists/lua-l/2021-11/msg00195.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P3EMGAQ5Y6GXJLY4K5DUOOEQT4MZ4J4F
access.redhat.com/security/cve/cve-2021-44647
security.gentoo.org/glsa/202305-23
nvd.nist.gov/vuln/detail/CVE-2021-44647
Show 17 moreShow less
github.com/advisories/GHSA-wvx9-9phh-9j3h
docs.bell-sw.com/security/cves/CVE-2021-44647
security-tracker.debian.org/tracker/CVE-2021-44647
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1632
ubuntu.com/security/CVE-2021-44647
cve.org/CVERecord?id=CVE-2021-44647
suse.com/security/cve/CVE-2021-43519