PT-2024-23868 · Redis+10 · Redis+10
Tomistripping
·
Published
2024-10-02
·
Updated
2026-05-18
·
CVE-2024-31228
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Redis versions prior to 6.2.16
Redis versions prior to 7.2.6
Redis versions prior to 7.4.1
Description
Redis, an open source, in-memory database, has a denial-of-service issue. Authenticated users can trigger this by using specially crafted, long string match patterns on supported commands such as
KEYS, SCAN, PSUBSCRIBE, FUNCTION LIST, COMMAND LIST, and ACL definitions. The matching of extremely long patterns may result in unbounded recursion, leading to stack overflow and process crash.Recommendations
For versions prior to 6.2.16, upgrade to version 6.2.16 or later.
For versions prior to 7.2.6, upgrade to version 7.2.6 or later.
For versions prior to 7.4.1, upgrade to version 7.4.1 or later.
Exploit
Fix
DoS
RCE
Uncontrolled Recursion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Red Hat
Red Os
Redis
Rocky Linux
Suse
Ubuntu