PT-2026-47117 · Julia · Lua Jll

Published 2026-05-26 · Updated 2026-05-26

OSV

In Lua 5.4.3, an erroneous finalizer called during a tail call leads to a heap-based buffer over-read.

Related Identifiers

JLSEC-2026-559

Affected Products

Lua Jll

References · 4

• https://osv.dev/vulnerability/JLSEC-2026-559 · Vendor Advisory
• https://github.com/lua/lua/commit/cf613cdc6fa367257fc61c256f63d917350858b5 · Note
• https://lua.org/bugs.html#5.4.3-11 · Note
• http://lua-users.org/lists/lua-l/2021-12/msg00019.html · Note