{"action":"Upgrade mruby to 2.1.2-3 or later.","affected":[{"fixed":"2.1.2-3","introduced":"0"}],"component":"mruby","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["2.1.2-3"],"id":"tcs_01M5NF333N48HNVSMPR1A632MS","modified_at":"2026-10-26T12:02:49.176843866Z","published_at":"2021-07-01T03:15:07.820Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2020-36401","https://security-tracker.debian.org/tracker/CVE-2020-36401"],"severity":{"label":"high","score":7.8},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2020-36401#Debian:13/mruby","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2020-36401"}],"summary":"mruby 2.1.2 has a double free in mrb_default_allocf (called from mrb_free and obj_free)."}