Skip to main content
VulnerabilityPublished Updated

lj_buf_ruleb128 · Tarantool: Heap-buffer-overflow

Affects tarantoolSource GCVE Database

0
Severity
High

Rated by Threat Radar

Data as of 23 Oct 2026, 19:14 UTC

What to do

Affected software

ProductAffectedFixed in
OSS-Fuzztarantoolpkg:generic/tarantoolOther threatsAffected
  • >=8ad443de995a7800906718925ce6c9162d80c4a9
  • =3.4.0
  • =3.4.1-entrypoint
  • =3.5.0-entrypoint
  • =3.4.1
  • =3.4.2-entrypoint
  • =3.5.0
  • =3.5.1-entrypoint
  • =3.6.0-entrypoint
  • =3.4.2
  • =3.4.3-entrypoint
  • =3.5.1
  • =3.5.2-entrypoint
  • =3.6.0
  • =3.6.1-entrypoint
  • =3.7.0-entrypoint
  • =3.6.1
  • =3.6.2-entrypoint
  • =3.6.2
  • =3.6.3-entrypoint
  • =3.7.0
  • =3.7.1-entrypoint
  • =3.8.0-entrypoint
  • =3.5.2
  • =3.6.3
  • =3.6.4-entrypoint
  • =3.5.3-entrypoint
  • =3.6.4
  • =3.7.1
  • =3.7.2-entrypoint
  • =3.8.0
  • =3.8.1-entrypoint
  • =3.9.0-entrypoint
  • =3.8.1
  • =3.8.2-entrypoint
  • =3.10.0-entrypoint
  • =3.7.2
  • =3.8.2
  • =3.8.3-entrypoint
  • =3.9.0
  • =3.9.1-entrypoint
Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Until an official fix is available, users should monitor vendor communications for updates and consider applying any recommended temporary mitigations if provided.

Description

A heap-buffer-overflow vulnerability exists in the Tarantool software within the lj_buf_ruleb128 function. This issue was discovered via OSS-Fuzz and involves a read overflow on the heap. Multiple specific versions of Tarantool are affected. There is no CVSS score or vendor patch information currently available, and no known exploits in the wild have been reported.

References

Community reviews

Loading reviews…