{"id":"CVE-2020-15888","details":"Lua through 5.4.0 mishandles the interaction between stack resizes and garbage collection, leading to a heap-based buffer overflow, heap-based buffer over-read, or use-after-free.","aliases":["BIT-lua-2020-15888"],"modified":"2026-07-08T20:30:32.483097Z","published":"2020-07-21T22:15:12.090Z","related":["openSUSE-SU-2024:11029-1","openSUSE-SU-2025:15401-1"],"references":[{"type":"FIX","url":"https://github.com/lua/lua/commit/6298903e35217ab69c279056f925fb72900ce0b7"},{"type":"FIX","url":"https://github.com/lua/lua/commit/eb41999461b6f428186c55abd95f4ce1a76217d5"},{"type":"EVIDENCE","url":"http://lua-users.org/lists/lua-l/2020-07/msg00053.html"},{"type":"EVIDENCE","url":"http://lua-users.org/lists/lua-l/2020-07/msg00054.html"},{"type":"EVIDENCE","url":"http://lua-users.org/lists/lua-l/2020-07/msg00071.html"},{"type":"EVIDENCE","url":"http://lua-users.org/lists/lua-l/2020-07/msg00079.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/lua/lua","events":[{"introduced":"c33b1728aeb7dfeec4013562660e07d32697aa6b"},{"last_affected":"c33b1728aeb7dfeec4013562660e07d32697aa6b"},{"fixed":"6298903e35217ab69c279056f925fb72900ce0b7"},{"fixed":"eb41999461b6f428186c55abd95f4ce1a76217d5"}],"database_specific":{"cpe":"cpe:2.3:a:lua:lua:5.4.0:-:*:*:*:*:*:*","extracted_events":[{"introduced":"5.4.0-NA"},{"last_affected":"5.4.0-NA"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["5.4.0-NA","v5.4.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15888.json","vanir_signatures_modified":"2026-07-08T20:30:32Z","vanir_signatures":[{"source":"https://github.com/lua/lua/commit/eb41999461b6f428186c55abd95f4ce1a76217d5","target":{"file":"ldo.h"},"deprecated":false,"digest":{"line_hashes":["130386227620455140858146550303983838314","53530003333973101310414257650565813173","28974977378586334153185605006886505404","136918642051494489778486467500759107040","328159481941225625655491816177627870490","186359140399090271729245150160144907014","307933728407298461961473498693164051109","18570838454356378009077054400105344104","276237006808805615248351817130758371705","300432671829517395228355465263980445269"],"threshold":0.9},"id":"CVE-2020-15888-0e454c8a","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["105135762939629227699804883912263599423","247486404441361576507022499946075620572","118496697812361212017269119553004280254","106424969772443140265390255039807120079","37540638878154083333708483624367283972","169294646749318997068984273064754916339","93724494676492250101028184475526945103","319218437690893170572963497387866274074"],"threshold":0.9},"id":"CVE-2020-15888-1356813b","signature_type":"Line","signature_version":"v1","source":"https://github.com/lua/lua/commit/eb41999461b6f428186c55abd95f4ce1a76217d5","target":{"file":"ltm.c"}},{"source":"https://github.com/lua/lua/commit/6298903e35217ab69c279056f925fb72900ce0b7","target":{"file":"ldo.c","function":"luaD_shrinkstack"},"deprecated":false,"digest":{"function_hash":"180637455239788581404342292874638595161","length":337},"id":"CVE-2020-15888-2d75f329","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/lua/lua/commit/6298903e35217ab69c279056f925fb72900ce0b7","target":{"file":"ldo.c"},"deprecated":false,"digest":{"line_hashes":["231483642368277910488853698800913036458","262414955084817609584224181936361745183","49450719460278863998359163241966262560","11043102250839843449606126582202505977","184449424765427880990090857574888028249","201550099967893807412619658723682673252","94801572708305704545442678458010346836","163722850367216824107617962342832113473"],"threshold":0.9},"id":"CVE-2020-15888-3952a7cf","signature_type":"Line"},{"id":"CVE-2020-15888-9f89c533","signature_type":"Line","signature_version":"v1","source":"https://github.com/lua/lua/commit/eb41999461b6f428186c55abd95f4ce1a76217d5","target":{"file":"lvm.c"},"deprecated":false,"digest":{"line_hashes":["20768315219636672424456947595552143535","312418570843409483009923973890277641613","253482659380919832210443693850598886815","120018164947122116008547476865049921541"],"threshold":0.9}}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}