Redis patched their vendored version of lua-cjson in Jul 2023 to fix a heap overflow issue and CVE-2022-24834 was assigned. It seems that those changes were never upstreamed.
We may want to merge the changes, like what OpenResty's fork did in openresty#94.
Redis patched their vendored version of lua-cjson in Jul 2023 to fix a heap overflow issue and CVE-2022-24834 was assigned. It seems that those changes were never upstreamed.
We may want to merge the changes, like what OpenResty's fork did in openresty#94.