Multiple critical vulnerabilities in LuaJIT (CVE-2024-25176, CVSS 9.8; CVE-2024-25178, CVSS 9.1; CVE-2024-25177, CVSS 7.5) allow an attacker to cause a denial of service or execute arbitrary code by providing specially crafted inputs. All versions of LuaJIT up to and including 2.1.0 are affected. Ubuntu has released patched packages for its supported LTS releases, and a standard system update will apply the necessary fixes.
Ubuntu Security Notices USN-8544-1 USN-8544-1: LuaJIT vulnerabilities Publication date 14 July 2026 Overview Several security issues were fixed in LuaJIT. Releases 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS 14.04 LTS Open side navigation Close side navigation Packages Details Update instructions References Packages luajit - Just-In-Time Compiler for Lua Details It was discovered that LuaJIT incorrectly handled certain inputs. An attacker could possibly use these issues to cause a crash, resulting in a denial of service, or execute arbitrary code. It was discovered that LuaJIT incorrectly handled certain inputs. An attacker could possibly use these issues to cause a crash, resulting in a denial of service, or execute arbitrary code. Update instructions In general, a standard system update will make all the necessary changes. Learn more about how to get the fixes. The problem can be corrected by updating your system to the following package versions: Ubuntu Release Package Version 24.04 LTS noble libluajit-5.1-2 – 2.1.0+git20231223.c525bcb+dfsg-1ubuntu0.1 libluajit-5.1-common – 2.1.0+git20231223.c525bcb+dfsg-1ubuntu0.1 luajit – 2.1.0+git20231223.c525bcb+dfsg-1ubuntu0.1 22.04 LTS jammy libluajit-5.1-2 – 2.1.0~beta3+dfsg-6ubuntu0.1 libluajit-5.1-common – 2.1.0~beta3+dfsg-6ubuntu0.1 luajit – 2.1.0~beta3+dfsg-6ubuntu0.1 20.04 LTS focal libluajit-5.1-2 – 2.1.0~beta3+dfsg-5.1ubuntu0.20.04.1~esm1 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future. libluajit-5.1-common – 2.1.0~beta3+dfsg-5.1ubuntu0.20.04.1~esm1 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future. luajit – 2.1.0~beta3+dfsg-5.1ubuntu0.20.04.1~esm1 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future. 18.04 LTS bionic libluajit-5.1-2 – 2.1.0~beta3+dfsg-5.1ubuntu0.18.04.1~esm1 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future. libluajit-5.1-common – 2.1.0~beta3+dfsg-5.1ubuntu0.18.04.1~esm1 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future. luajit – 2.1.0~beta3+dfsg-5.1ubuntu0.18.04.1~esm1 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future. 16.04 LTS xenial libluajit-5.1-2 – 2.0.4+dfsg-1+deb9u1ubuntu0.1~esm1 libluajit-5.1-common – 2.0.4+dfsg-1+deb9u1ubuntu0.1~esm1 luajit – 2.0.4+dfsg-1+deb9u1ubuntu0.1~esm1 14.04 LTS trusty libluajit-5.1-2 – 2.0.2+dfsg-1ubuntu0.1~esm1 Ubuntu Pro Fix available with Ubuntu Pro via Legacy Support add-on. libluajit-5.1-common – 2.0.2+dfsg-1ubuntu0.1~esm1 Ubuntu Pro Fix available with Ubuntu Pro via Legacy Support add-on. luajit – 2.0.2+dfsg-1ubuntu0.1~esm1 Ubuntu Pro Fix available with Ubuntu Pro via Legacy Support add-on. Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines. Get Ubuntu Pro References CVE-2024-25178 CVE-2024-25177 CVE-2024-25176 CVE-2024-25178 CVE-2024-25177 CVE-2024-25176