Skip to content
Fencer Vulns
critical 9.1

CVE-2019-19391 json

In LuaJIT through 2.0.5, as used in Moonjit before 2.1.2 and other products, debug.getinfo has a type confusion issue that leads to arbitra…

published 2019-11-29 6 y ago modified 2026-06-17 4 mo ago also EUVD-2019-9012

cvss
9.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.4%
EPSS 1.4% chance of exploitation in 30 days, percentile 72%
public exploits
0
none known

Summary

In LuaJIT through 2.0.5, as used in Moonjit before 2.1.2 and other products, debug.getinfo has a type confusion issue that leads to arbitrary memory write or read operations, because certain cases involving valid stack levels and > options are mishandled. NOTE: The LuaJIT project owner states that the debug libary is unsafe by definition and that this is not a vulnerability. When LuaJIT was originally developed, the expectation was that the entire debug library had no security guarantees and thus it made no sense to assign CVEs. However, not all users of later LuaJIT derivatives share this perspective

Patch / fix

  • moonjit_project moonjit 2.1.2
  • luajit Debian 14, Debian 13, Debian 12 2.1.0~beta3+git20210112+dfsg-2

debian advisories DEBIAN-CVE-2019-19391

  • luajit openSUSE Tumbleweed 2.1.20250826-1.1

opensuse advisories openSUSE-SU-2025:15672-1

  • sysbench Azure Linux 3.0 1.0.20-3

azure linux advisories AZL-41306

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

1.40% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD 2.0 6.4 AV:N/AC:L/Au:N/C:P/I:P/A:N

Classification

Weakness
  • CWE-843 Access of Resource Using Incompatible Type

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.