CVE catalog

CVE-2019-19391

luajit: CVE-2019-19391

[CVE catalog]

Severity
Critical · CVSS 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
1.40% · Oct 25, 2026

In LuaJIT through 2.0.5, as used in Moonjit before 2.1.2 and other products, debug.getinfo has a type confusion issue that leads to arbitrary memory write or read operations, because certain cases involving valid stack levels and > options are mishandled. NOTE: The LuaJIT project owner states that the debug libary is unsafe by definition and that this is not a vulnerability. When LuaJIT was originally developed, the expectation was that the entire debug library had no security guarantees and thus it made no sense to assign CVEs. However, not all users of later LuaJIT derivatives share this perspective

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianluajitsid2.1.0+openresty20251030-1fixed
Debianluajitforky2.1.0+openresty20251030-1fixed
Debianluajittrixie2.1.0+openresty20250117-2fixed
Debianluajitbookworm2.1.0~beta3+git20220320+dfsg-4.1+deb12u1fixed
Opensuseluajittumbleweed2.1.20250826-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianluajitsourcesid2.1.0~beta3+git20210112+dfsg-2unimportantNot reported[946053]
Debianluajitsourceforky2.1.0~beta3+git20210112+dfsg-2unimportantNot reported[946053]
Debianluajitsourcetrixie2.1.0~beta3+git20210112+dfsg-2unimportantNot reported[946053]
Debianluajitsourcebookworm2.1.0~beta3+git20210112+dfsg-2unimportantNot reported[946053]
Opensuseluajitrpmtumbleweed2.1.20250826-1.1Not reportedOPENSUSE-SU-2025:15672-1Not reported

[Debian bug #946053]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [libluajit-5_1-2]Unknown

    Source package: [luajit]

    Details (1)

    • 2.1.20250826-3.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.1.20250826-1.1

      Version impact unknown

      dsa · luajit · opensuse · tumbleweed

  • [libluajit-5_1-2-32bit]Unknown

    Source package: [luajit]

    Details (1)

    • 2.1.20250826-3.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.1.20250826-1.1

      Version impact unknown

      dsa · luajit · opensuse · tumbleweed

  • [luajit-devel]Unknown

    Source package: [luajit]

    Details (1)

    • 2.1.20250826-3.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.1.20250826-1.1

      Version impact unknown

      dsa · luajit · opensuse · tumbleweed

  • [luajit]Fixed

    Source package: [luajit]

    Details (1)

    • 2.1.20250826-3.3 · x86_64 · tumbleweed

      Fixed · Fixed: 2.1.20250826-1.1

      dsa · luajit · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [libluajit-5.1-2]Fixed

    Source package: [luajit]

    Details (2)

    • 2.1.0~beta3+git20220320+dfsg-4.1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 2.1.0~beta3+git20210112+dfsg-2

      dsa · luajit · debian · bookworm; dsa · luajit · debian · 12

    • 2.1.0~beta3+git20220320+dfsg-4.1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 2.1.0~beta3+git20210112+dfsg-2

      dsa · luajit · debian · bookworm; dsa · luajit · debian · 12

  • [libluajit-5.1-common]Fixed

    Source package: [luajit]

    Details (2)

    • 2.1.0~beta3+git20220320+dfsg-4.1+deb12u1 · all · bookworm

      Fixed · Fixed: 2.1.0~beta3+git20210112+dfsg-2

      dsa · luajit · debian · bookworm; dsa · luajit · debian · 12

    • 2.1.0~beta3+git20220320+dfsg-4.1+deb12u1 · all · bookworm

      Fixed · Fixed: 2.1.0~beta3+git20210112+dfsg-2

      dsa · luajit · debian · bookworm; dsa · luajit · debian · 12

  • [libluajit-5.1-dev]Fixed

    Source package: [luajit]

    Details (2)

    • 2.1.0~beta3+git20220320+dfsg-4.1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 2.1.0~beta3+git20210112+dfsg-2

      dsa · luajit · debian · bookworm; dsa · luajit · debian · 12

    • 2.1.0~beta3+git20220320+dfsg-4.1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 2.1.0~beta3+git20210112+dfsg-2

      dsa · luajit · debian · bookworm; dsa · luajit · debian · 12

  • [luajit]Fixed
    Details (2)

    • 2.1.0~beta3+git20220320+dfsg-4.1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 2.1.0~beta3+git20210112+dfsg-2

      dsa · luajit · debian · bookworm; dsa · luajit · debian · 12

    • 2.1.0~beta3+git20220320+dfsg-4.1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 2.1.0~beta3+git20210112+dfsg-2

      dsa · luajit · debian · bookworm; dsa · luajit · debian · 12

[Debian 13 (Trixie)]

  • [libluajit-5.1-2]Fixed

    Source package: [luajit]

    Details (4)

    • 2.1.0+openresty20250117-2 · amd64 · trixie

      Fixed · Fixed: 2.1.0~beta3+git20210112+dfsg-2

      dsa · luajit · debian · 13

    • 2.1.0+openresty20250117-2 · arm64 · trixie

      Fixed · Fixed: 2.1.0~beta3+git20210112+dfsg-2

      dsa · luajit · debian · 13

    • 2.1.0+openresty20251030-1~bpo13+1 · amd64 · trixie-backports

      Fixed · Fixed: 2.1.0~beta3+git20210112+dfsg-2

      dsa · luajit · debian · 13

    • 2.1.0+openresty20251030-1~bpo13+1 · arm64 · trixie-backports

      Fixed · Fixed: 2.1.0~beta3+git20210112+dfsg-2

      dsa · luajit · debian · 13

  • [libluajit-5.1-common]Fixed

    Source package: [luajit]

    Details (4)

    • 2.1.0+openresty20250117-2 · all · trixie

      Fixed · Fixed: 2.1.0~beta3+git20210112+dfsg-2

      dsa · luajit · debian · 13

    • 2.1.0+openresty20250117-2 · all · trixie

      Fixed · Fixed: 2.1.0~beta3+git20210112+dfsg-2

      dsa · luajit · debian · 13

    • 2.1.0+openresty20251030-1~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 2.1.0~beta3+git20210112+dfsg-2

      dsa · luajit · debian · 13

    • 2.1.0+openresty20251030-1~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 2.1.0~beta3+git20210112+dfsg-2

      dsa · luajit · debian · 13

  • [libluajit-5.1-dev]Fixed

    Source package: [luajit]

    Details (4)

    • 2.1.0+openresty20250117-2 · amd64 · trixie

      Fixed · Fixed: 2.1.0~beta3+git20210112+dfsg-2

      dsa · luajit · debian · 13

    • 2.1.0+openresty20250117-2 · arm64 · trixie

      Fixed · Fixed: 2.1.0~beta3+git20210112+dfsg-2

      dsa · luajit · debian · 13

    • 2.1.0+openresty20251030-1~bpo13+1 · amd64 · trixie-backports

      Fixed · Fixed: 2.1.0~beta3+git20210112+dfsg-2

      dsa · luajit · debian · 13

    • 2.1.0+openresty20251030-1~bpo13+1 · arm64 · trixie-backports

      Fixed · Fixed: 2.1.0~beta3+git20210112+dfsg-2

      dsa · luajit · debian · 13

  • [luajit]Fixed
    Details (4)

    • 2.1.0+openresty20250117-2 · amd64 · trixie

      Fixed · Fixed: 2.1.0~beta3+git20210112+dfsg-2

      dsa · luajit · debian · 13

    • 2.1.0+openresty20250117-2 · arm64 · trixie

      Fixed · Fixed: 2.1.0~beta3+git20210112+dfsg-2

      dsa · luajit · debian · 13

    • 2.1.0+openresty20251030-1~bpo13+1 · amd64 · trixie-backports

      Fixed · Fixed: 2.1.0~beta3+git20210112+dfsg-2

      dsa · luajit · debian · 13

    • 2.1.0+openresty20251030-1~bpo13+1 · arm64 · trixie-backports

      Fixed · Fixed: 2.1.0~beta3+git20210112+dfsg-2

      dsa · luajit · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]