Duplicate - please ignore

[jinchengyang98]

This issue was submitted in error. Please ignore.

[jinchengyang98]

Hi maintainers,

This is a critical use-after-free vulnerability (CVE-2025-49844) discovered at Pwn2Own Berlin 2025 by Wiz. It has existed for ~13 years in the Lua parser.

I have verified that KeyDB's deps/lua/src/lparser.c at line 387 still contains the vulnerable pattern — luaS_new(L, name) is passed directly to luaX_setinput() without being anchored on the Lua stack, allowing GC to free it prematurely.

Would you consider creating a GitHub Security Advisory and requesting a CVE ID for KeyDB? The upstream CVE only lists Redis.

Steps: Security tab → Advisories → New draft advisory → Request CVE ID.

Thank you!