yikes, this is bad

Would think most forks would be affected as well (?)

I'm assuming this has also been addressed in Valkey and most prominent forks as well.

I'm assuming this is why Ubuntu's unattended-upgrades service uncerimoniously restarted the redis-server process on my machine late September?

Good news that it was found and fixed, but 140 days response time seems rather slow for such a critical vulnerability

Seems similar in impact to https://nvd.nist.gov/vuln/detail/cve-2021-32626, I wonder why this has a CVE 10.

This code also looks generally fixed in Lua5.4, https://github.com/lua/lua/blame/9ea06e61f20ae34974226074fc6.... Valkey and Redis really need to move to Lua that isn't so old.