CVE-2024-25115: RedisBloom heap buffer overflow in CF.LOADCHUNK command
RedisBloom adds a set of probabilistic data structures to Redis. Starting in version 2.0.0 and prior to version 2.4.7 and 2.6.10, specially crafted CF.LOADCHUNK commands may be used by authenticated users to perform heap overflow, which may lead to remote code execution. The problem is fixed in RedisBloom 2.4.7 and 2.6.10.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-25115?
CVE-2024-25115 has a high severity due to its potential for remote code execution through heap overflow.
How do I fix CVE-2024-25115?
To fix CVE-2024-25115, upgrade RedisBloom to version 2.4.7 or 2.6.10 or later.
Who is affected by CVE-2024-25115?
CVE-2024-25115 affects RedisBloom versions from 2.0.0 up to, but not including, 2.4.7 and 2.6.10.
What causes CVE-2024-25115?
CVE-2024-25115 is caused by specially crafted `CF.LOADCHUNK` commands that can lead to heap overflow.
Can authenticated users exploit CVE-2024-25115?
Yes, authenticated users can exploit CVE-2024-25115 to execute remote code.