Redis vulnerabilities

Redis before version 3.2.7 is vulnerable to 'Cross Protocol Scripting' due to a lack of checks for POST and Host: strings, which are not valid in the Redis protocol.

Integer overflow in the getnum function in lua_struct.c in Redis 2.8.x before 2.8.24 and 3.0.x before 3.0.6 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number, which triggers a stack-based buffer overflow.

Redis versions before 2.8.21 and 3.x before 3.0.2 allow remote attackers to execute arbitrary Lua bytecode via the eval command.

Redis is an open source, in-memory database that persists on disk. In versions 8.2.0 and above, a user can run the XACKDEL command with multiple ID's and trigger a stack buffer overflow, which may potentially lead to remote code execution. This issue is fixed in version 8.2.3. To workaround this issue without patching the redis-server executable is to prevent users from executing XACKDEL operation. This can be done using ACL to restrict XACKDEL command.

In Redis 7.0 prior to 7.0.12, a vulnerability exists that may lead to a heap overflow when extracting key names from a command and a list of arguments. This can result in reading random heap memory, heap corruption, and potentially remote code execution.

The clusterLoadConfig function in Redis 4.0.2 allows attackers to cause a denial of service (out-of-bounds array index and application crash) by leveraging 'limited access to the machine'.

A buffer overflow in Redis versions 3.2.x prior to 3.2.4 can lead to arbitrary code execution when a crafted command is sent. An out of bounds write vulnerability exists in the handling of the client-output-buffer-limit option during the CONFIG SET command.

A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed.

Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server.

Redis before version 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer. Deleting both consumers via XGROUP DELCONSUMER leads to a double free. This issue exists because of an incomplete fix for CVE-2026-25243.

A vulnerability in Redis up to version 8.6.3 allows an authenticated attacker to execute remote code via crafted data in the RESTORE command due to improper validation of serialized values.

Redis with Lua scripting enabled contains a use-after-free vulnerability in the master-replica synchronization mechanism. An authenticated attacker can exploit replicas with replica-read-only disabled to achieve remote code execution.

A use-after-free vulnerability in Redis-server versions 7.2.0 through 8.6.3 occurs when an error return from `processCommandAndResetClient` is not handled during blocked command re-execution. An authenticated attacker can exploit this to achieve remote code execution.

Redis versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server, leading to denial of service. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2.

In Redis versions 8.2.1 and below, an authenticated user can use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. The problem exists in all Redis versions with Lua scripting. Fixed in version 8.2.2.

Redis versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2.

An open database issue exists in the affected product due to an over permissive Redis instance. An attacker on the intranet can access sensitive data and potentially alter data.

A segmentation fault in the redis-server component of Redis 5.0.7 leads to a denial of service (DOS). The vendor cannot reproduce this issue in a released version, such as 5.0.7.