In lua you will typically lua_pcall() the entry function written in Lua, but it will often call back into your C functions to do various tasks. Now if your C functions do anything with the lua stack, that might cause OOM, but now your lua_pcall() will catch that - or any sort of error catching inside Lua itself - and you’ll be looking at an accidental recovery situation.

At least that was how things looked like when I last poked around Lua a few months ago.

So as far as I know, it’s actually not trivial to make Lua safely abort on OOM, and it’s not the default behavior. I also don’t think there are lua_push* function alternatives available using the default C API that don’t longjmp in a likely often unsafe manner out of your C code if you use them and you hit OOM.

Summed up, I would expect many Lua integrations to have the same problem.

but what about vulnerabilities in the web server? 😱

What about Lua? https://hachyderm.io/@ell1e/117480515499692140 I think e.g. nginx and OpenDKIM have Lua scripting integrations.