Heap Buffer Overflow Vulnerability in Tarantool: Critical Security Flaw Detected
Summary
OSV-2026-1027: Heap-buffer-overflow in mp_load_float. Affects tarantool versions >= c679fad72328070e9d94426077b8cc45c390e313, < 42d7de284ffb896006e74a51fbd0f62318b813ba. Fixed in 42d7de284ffb896006e74a51fbd0f62318b813ba. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Tarantool is an open-source in-memory database and application server designed for high performance and scalability. It supports Lua scripting and is often used for real-time applications. However, like many software packages, it can be susceptible to vulnerabilities that may compromise its integrity and security. The recent discovery of a heap buffer overflow in the mp_load_float function poses a significant risk to users of Tarantool, potentially leading to unauthorized access or data corruption.
Vulnerability Detail
The vulnerability identified is a heap buffer overflow occurring in the mp_load_float function, which is part of the decoding process in Tarantool. This flaw allows for writing beyond the allocated memory buffer, which can lead to crashes or arbitrary code execution. The issue was reported through OSS-Fuzz, indicating that it can be exploited under certain conditions, particularly when handling floating-point data. The ramifications of this vulnerability are severe, as it can compromise the stability and security of applications relying on Tarantool.
How To Fix
Minimum fixed version
42d7de284ffb896006e74a51fbd0f62318b813ba
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid processing untrusted floating-point data until the patch is applied. This can help mitigate the risk of exploitation until the software is updated.
Conclusion
The heap buffer overflow vulnerability in Tarantool's mp_load_float function is a critical issue that requires immediate attention. Users are strongly encouraged to update to the patched version to safeguard their applications against potential exploits. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time, ensuring better security for your software.
See every vulnerability recorded for tarantool →
FAQ
A heap buffer overflow occurs when a program writes more data to a buffer located on the heap than it can hold, potentially overwriting adjacent memory and leading to unpredictable behavior.
Exploitation of this vulnerability can lead to application crashes, data corruption, or even remote code execution, compromising the security of your application.
If you are using a version of Tarantool between the introduced commit c679fad72328070e9d94426077b8cc45c390e313 and the fixed commit 42d7de284ffb896006e74a51fbd0f62318b813ba, your version is affected.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply using a manifest file like package-lock.json, you can check if your application is affected by this vulnerability.
If immediate updates are not possible, avoid processing untrusted floating-point data as a temporary measure to reduce risk until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for tarantool.
