Heap Buffer Overflow Vulnerability in Tarantool - OSV-2025-437
Summary
OSV-2025-437: Heap-buffer-overflow in mmcall. Affects tarantool versions >= 46ee17556f2e1a7d65f20383f5e0ff3381998a27, < 8c7cfb1cd0b3f5ce1d5b181403f68f7aaf657d9a. Fixed in 8c7cfb1cd0b3f5ce1d5b181403f68f7aaf657d9a. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Tarantool is an open-source in-memory database and application server designed for high performance and scalability. It supports Lua scripting and is often used for building real-time applications. This vulnerability exposes Tarantool to potential crashes and data corruption due to improper memory handling.
Vulnerability Detail
The vulnerability identified as OSV-2025-437 is a heap-buffer-overflow that occurs during the execution of the mmcall function in Tarantool. This issue can lead to a crash of the application, allowing attackers to exploit the overflow to write data outside the allocated memory buffer. The crash state is triggered by specific Lua meta-method calls, which can be manipulated to cause unintended behavior. The severity of this vulnerability is classified as HIGH, indicating a significant risk to applications using this version of Tarantool.
How To Fix
Minimum fixed version
8c7cfb1cd0b3f5ce1d5b181403f68f7aaf657d9a
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to update to the patched version immediately, consider implementing input validation and sanitization in your application to mitigate the risk of triggering the heap-buffer-overflow. Additionally, monitor your application for unusual behavior that may indicate an exploit attempt.
Conclusion
The heap buffer overflow vulnerability in Tarantool (OSV-2025-437) poses a significant risk to applications using affected versions. It is crucial to update to the patched version to mitigate this risk. Utilizing tools like Vulert can assist in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for tarantool →
FAQ
A heap buffer overflow occurs when a program writes more data to a buffer located on the heap than it was allocated for, potentially overwriting adjacent memory and leading to crashes or security vulnerabilities.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to access the code.
Exploiting this vulnerability could lead to application crashes, data corruption, or unauthorized access to sensitive information, depending on how the overflow is manipulated.
Regularly updating your software dependencies and implementing secure coding practices can help prevent vulnerabilities like heap buffer overflows. Additionally, using tools like Vulert can help you stay informed about new vulnerabilities.
If you cannot update to the patched version right away, implement input validation and monitor your application for any suspicious activity as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for tarantool.
