CVE-2020-9434: Lua-OpenSSL Project Lua-OpenSSL

Critical severity, CVSS 9.1. EPSS: 0.8% chance of exploitation in the next 30 days.

openssl_x509_check_ip_asc in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-boolean return values.

Affected products

• Lua-OpenSSL Project Lua-OpenSSL: version 0.7.7-1 only

Published 2020-02-27. Last modified 2026-06-17.