PatchTheCVECVE-2019-19391: In LuaJIT through 2.0.5, as used in Moonjit before 2.1.2 and other products, debug.getinfo has a type confusio
CVE-2019-19391 is a critical-severity flaw (CVSS 9.1) affecting luajit, moonjit. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
In LuaJIT through 2.0.5, as used in Moonjit before 2.1.2 and other products, debug.getinfo has a type confusion issue that leads to arbitrary memory write or read operations, because certain cases involving valid stack levels and > options are mishandled. NOTE: The LuaJIT project owner states that the debug libary is unsafe by definition and that this is not a vulnerability. When LuaJIT was originally developed, the expectation was that the entir
Why this priority
- Critical severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.1 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 1.4% (top 28%) |
| CISA exploited list | No |
| Weakness | CWE-843 |
| Published | 2019-11-29 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2019-19391?
luajit: upgrade to newer than 2.0.5; moonjit: upgrade to 2.1.2. Exact commands for each OS are on this page.
Is CVE-2019-19391 being exploited?
CVE-2019-19391 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2019-19391 affect?
CVE-2019-19391 affects luajit, moonjit. Severity is critical (CVSS 9.1). In LuaJIT through 2.0.5, as used in Moonjit before 2.1.2 and other products, debug.getinfo has a type confusion issue that leads to arbitrary memory write or read operations, because certain cases involving valid stack levels and > options
How urgent is CVE-2019-19391?
Priority 55/100. Critical severity; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2024-25178 CRITICAL 9.1 UPGRADE LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an out-of-bounds read in the stack-overflow
- CVE-2024-25177 HIGH 7.5 UPGRADE LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an unsinking of IR_FSTORE for NULL metatabl
- CVE-2024-25176 CRITICAL 9.8 UPGRADE LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240626 have a stack-buffer-overflow in lj_strfmt_wfnum
- CVE-2020-24372 HIGH 7.5 UPGRADE LuaJIT through 2.1.0-beta3 has an out-of-bounds read in lj_err_run in lj_err.c.
- CVE-2020-15890 HIGH 7.5 UPGRADE MITIGATE LuaJit through 2.1.0-beta3 has an out-of-bounds read because __gc handler frame traversal is mishandled.