Every CVE Search/ Get API key

CVE-2024-25177

LuaJIT through 2.1 has an unsinking of IR_FSTORE for NULL metatable, which leads to Denial of...

7.5 HighFix available

LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an unsinking of IR_FSTORE for NULL metatable, which leads to Denial of Service (DoS).

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.57%Up 0.6 points since Jul 8, 2025
90%50%10%1%

What each source reports

CVE List Score used 7.5

LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an unsinking of IR_FSTORE for NULL metatable, which leads to Denial of Service (DoS).

Record
CVE-2024-25177
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
EUVDEUVD-2024-22513 7.5

LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an unsinking of IR_FSTORE for NULL metatable, which leads to Denial of Service (DoS).

Record
EUVD-2024-22513
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-f734-p3hx-8cw4 7.5

LuaJIT through 2.1 has an unsinking of IR_FSTORE for NULL metatable, which leads to Denial of...

LuaJIT through 2.1 has an unsinking of IR_FSTORE for NULL metatable, which leads to Denial of Service (DoS).

Record
GHSA-f734-p3hx-8cw4
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
NVD 7.5

LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an unsinking of IR_FSTORE for NULL metatable, which leads to Denial of Service (DoS).

Record
CVE-2024-25177
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSVALPINE-CVE-2024-25177 7.5

LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an unsinking of IR_FSTORE for NULL metatable, which leads to Denial of Service (DoS).

Record
ALPINE-CVE-2024-25177
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBELL-CVE-2024-25177 7.5
Record
BELL-CVE-2024-25177
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 8 moreShow less
OSV 7.5

LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an unsinking of IR_FSTORE for NULL metatable, which leads to Denial of Service (DoS).

Record
CVE-2024-25177
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-04
OSVDEBIAN-CVE-2024-25177 7.5

LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an unsinking of IR_FSTORE for NULL metatable, which leads to Denial of Service (DoS).

Record
DEBIAN-CVE-2024-25177
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2024-25177 7.5

LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an unsinking of IR_FSTORE for NULL metatable, which leads to Denial of Service (DoS).

Record
UBUNTU-CVE-2024-25177
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-65535 No score

CVE-2024-25177 affecting package luajit for versions less than 2.1.0-28

LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an unsinking of IR_FSTORE for NULL metatable, which leads to Denial of Service (DoS).

Record
AZL-65535
Updated
2026-11-02
OSVMGASA-2026-0225 No score

Updated luajit packages fix security vulnerabilities

In LuaJIT through 2.0.5, as used in Moonjit before 2.1.2 and other products, debug.getinfo has a type confusion issue that leads to arbitrary memory write or read operations, because certain cases involving valid stack levels and > options are mishandled. (CVE-2019-19391) LuaJIT through 2.1.0-beta3 has an out-of-bounds read in lj_err_run in lj_err.c. (CVE-2020-24372) LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240626 have a stack-buffer-overflow in lj_strfmt_wfnum in lj_strfmt_num.c. (CVE-2024-25176) LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an unsinking of IR_FSTORE for NULL metatable, which leads to Denial of Service (DoS). (CVE-2024-25177) LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an out-of-bounds read in the stack-overflow handler in lj_state.c. (CVE-2024-25178)

Record
MGASA-2026-0225
Updated
2026-11-02
OSVSUSE-SU-2025:02886-1 No score

Security update for lua51-luajit

This update for lua51-luajit fixes the following issues:

  • CVE-2024-25176: Fixed stack-buffer-overflow in lj_strfmt_wfnum in lj_strfmt_num.c (bsc#1246077)
  • CVE-2024-25177: Fixed unsinking of IR_FSTORE for NULL metatable (bsc#1246078)
  • CVE-2024-25178: Fixed ut-of-bounds read in the stack-overflow handler in lj_state.c (bsc#1246079)
Record
SUSE-SU-2025:02886-1
Updated
2026-11-02
OSVSUSE-SU-2025:03378-1 No score

Security update for luajit

This update for luajit fixes the following issues:

  • CVE-2024-25176: Fixed stack-buffer-overflow in lj_strfmt_wfnum in lj_strfmt_num.c (bsc#1246077)
  • CVE-2024-25177: Fixed unsinking of IR_FSTORE for NULL metatable (bsc#1246078)
  • CVE-2024-25178: Fixed out-of-bounds read in the stack-overflow handler in lj_state.c (bsc#1246079)
Record
SUSE-SU-2025:03378-1
Updated
2026-11-02
OSVUSN-8544-1 No score

luajit vulnerabilities

It was discovered that LuaJIT incorrectly handled certain inputs. An attacker could possibly use these issues to cause a crash, resulting in a denial of service, or execute arbitrary code.

Record
USN-8544-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
luajit
Alpine:v3.19
 before 2.1_p20240815-r1
2.1_p20240815-r1
luajit
Alpine:v3.20
 before 2.1_p20240815-r1
2.1_p20240815-r1
luajit
Alpine:v3.21
 before 2.1_p20240815-r1
2.1_p20240815-r1
luajit
Alpine:v3.22
 before 2.1_p20240815-r1
2.1_p20240815-r1
luajit
Alpine:v3.23
 before 2.1_p20240815-r1
2.1_p20240815-r1
luajit
Alpine:v3.24
 before 2.1_p20240815-r1
2.1_p20240815-r1
luajit
Azure Linux:2
 before 2.1.0-28
2.1.0-28
luajit
Alpaquita:23
 2.1_p20210510-r3 up to 2.1_p20210510-r4
2.1_p20210510-r4
luajit
Alpaquita:stream
 2.1_p20210510-r3 up to 2.1_p20240314-r0
2.1_p20240314-r0
luajit
Debian:12
 before 2.1.0~beta3+git20220320+dfsg-4.1+deb12u1, plus listed versions
2.1.0~beta3+git20220320+dfsg-4.1
2.1.0~beta3+git20220320+dfsg-4.1+deb12u1
Show 25 moreShow less
Affected packages
PackageAffectedFixed
luajit
Debian:13
 before 2.1.0+openresty20240314-1
2.1.0+openresty20240314-1
luajit
Debian:14
 before 2.1.0+openresty20240314-1
2.1.0+openresty20240314-1
luajit
Debian:11
From an advisory covering 6 CVEs
 before 2.1.0~beta3+dfsg-5.3+deb11u1, plus listed versions
2.1.0~beta3+dfsg-5.3
2.1.0~beta3+dfsg-5.3+deb11u1
luajit
Mageia:9
From an advisory covering 5 CVEs
 before 2.1.0-0.beta3.10.1.mga9
2.1.0-0.beta3.10.1.mga9
lua51-luajit
openSUSE:Leap 15.6
From an advisory covering 3 CVEs
 before 2.1.0~beta2-150000.3.3.1
2.1.0~beta2-150000.3.3.1
luajit
SUSE:Linux Enterprise Module for Basesystem 15 SP6
From an advisory covering 3 CVEs
 before 2.1.0~beta3+git.1624618403.e9577376-150400.4.5.1
2.1.0~beta3+git.1624618403.e9577376-150400.4.5.1
luajit
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 3 CVEs
 before 2.1.0~beta3+git.1624618403.e9577376-150400.4.5.1
2.1.0~beta3+git.1624618403.e9577376-150400.4.5.1
luajit
SUSE:Linux Enterprise Module for Package Hub 15 SP6
From an advisory covering 3 CVEs
 before 2.1.0~beta3+git.1624618403.e9577376-150400.4.5.1
2.1.0~beta3+git.1624618403.e9577376-150400.4.5.1
luajit
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 3 CVEs
 before 2.1.0~beta3+git.1624618403.e9577376-150400.4.5.1
2.1.0~beta3+git.1624618403.e9577376-150400.4.5.1
luajit
openSUSE:Leap 15.6
From an advisory covering 3 CVEs
 before 2.1.0~beta3+git.1624618403.e9577376-150400.4.5.1
2.1.0~beta3+git.1624618403.e9577376-150400.4.5.1
luajit
Ubuntu:Pro:14.04:LTS
 before 2.0.2+dfsg-1ubuntu0.1~esm1, plus listed versions
2.0.2+dfsg-1
2.0.2+dfsg-1ubuntu0.1~esm1
luajit
Ubuntu:Pro:16.04:LTS
 before 2.0.4+dfsg-1+deb9u1ubuntu0.1~esm1, plus listed versions
2.0.4+dfsg-12.0.4+dfsg-1+deb9u1build0.16.04.1
2.0.4+dfsg-1+deb9u1ubuntu0.1~esm1
luajit
Ubuntu:Pro:18.04:LTS
 before 2.1.0~beta3+dfsg-5.1ubuntu0.18.04.1~esm1, plus listed versions
2.0.4+dfsg-12.1.0~beta3+dfsg-52.1.0~beta3+dfsg-5.1
2.1.0~beta3+dfsg-5.1ubuntu0.18.04.1~esm1
luajit
Ubuntu:Pro:20.04:LTS
 before 2.1.0~beta3+dfsg-5.1ubuntu0.20.04.1~esm1, plus listed versions
2.1.0~beta3+dfsg-5.12.1.0~beta3+dfsg-5.1build1
2.1.0~beta3+dfsg-5.1ubuntu0.20.04.1~esm1
luajit
Ubuntu:22.04:LTS
 before 2.1.0~beta3+dfsg-6ubuntu0.1, plus listed versions
2.1.0~beta3+dfsg-6
2.1.0~beta3+dfsg-6ubuntu0.1
luajit
Ubuntu:24.04:LTS
 before 2.1.0+git20231223.c525bcb+dfsg-1ubuntu0.1, plus listed versions
2.1.0~beta3+git20220320+dfsg-4.12.1.0+git20231223.c525bcb+dfsg-1~build12.1.0+git20231223.c525bcb+dfsg-1
2.1.0+git20231223.c525bcb+dfsg-1ubuntu0.1
luajit
Ubuntu:25.10
 All versions, plus listed versions
2.1.0+openresty20250117-22.1.0+openresty20250117-2ubuntu1
 None known
luajit
Ubuntu:26.10
 All versions, plus listed versions
2.1.0+openresty20251030-1
 None known
luajit
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.1.0+openresty20250117-2ubuntu12.1.0+openresty20251030-1
 None known
luajit
Ubuntu:Pro:14.04:LTS
From an advisory covering 3 CVEs
 before 2.0.2+dfsg-1ubuntu0.1~esm1, plus listed versions
2.0.2+dfsg-1
2.0.2+dfsg-1ubuntu0.1~esm1
luajit
Ubuntu:Pro:16.04:LTS
From an advisory covering 3 CVEs
 before 2.0.4+dfsg-1+deb9u1ubuntu0.1~esm1, plus listed versions
2.0.4+dfsg-12.0.4+dfsg-1+deb9u1build0.16.04.1
2.0.4+dfsg-1+deb9u1ubuntu0.1~esm1
luajit
Ubuntu:Pro:18.04:LTS
From an advisory covering 3 CVEs
 before 2.1.0~beta3+dfsg-5.1ubuntu0.18.04.1~esm1, plus listed versions
2.0.4+dfsg-12.1.0~beta3+dfsg-52.1.0~beta3+dfsg-5.1
2.1.0~beta3+dfsg-5.1ubuntu0.18.04.1~esm1
luajit
Ubuntu:Pro:20.04:LTS
From an advisory covering 3 CVEs
 before 2.1.0~beta3+dfsg-5.1ubuntu0.20.04.1~esm1, plus listed versions
2.1.0~beta3+dfsg-5.12.1.0~beta3+dfsg-5.1build1
2.1.0~beta3+dfsg-5.1ubuntu0.20.04.1~esm1
luajit
Ubuntu:22.04:LTS
From an advisory covering 3 CVEs
 before 2.1.0~beta3+dfsg-6ubuntu0.1, plus listed versions
2.1.0~beta3+dfsg-6
2.1.0~beta3+dfsg-6ubuntu0.1
luajit
Ubuntu:24.04:LTS
From an advisory covering 3 CVEs
 before 2.1.0+git20231223.c525bcb+dfsg-1ubuntu0.1, plus listed versions
2.1.0~beta3+git20220320+dfsg-4.12.1.0+git20231223.c525bcb+dfsg-1~build12.1.0+git20231223.c525bcb+dfsg-1
2.1.0+git20231223.c525bcb+dfsg-1ubuntu0.1

History

History
RecordedChangedSources
affectedOSV
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-25177 is a high vulnerability (CVSS 7.5) in Luajit, published July 7, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.57%, the 47th percentile. Fixed in luajit 2.1_p20240815-r1.

References

Show 21 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open