CVE-2024-25116: Specially crafted CF.RESERVE command can lead to denial-of-service
RedisBloom adds a set of probabilistic data structures to Redis. Starting in version 2.0.0 and prior to version 2.4.7 and 2.6.10, authenticated users can use the CF.RESERVE command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in RedisBloom 2.4.7 and 2.6.10.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-25116?
CVE-2024-25116 is classified as a critical severity vulnerability due to the risk of server termination.
How do I fix CVE-2024-25116?
To fix CVE-2024-25116, update RedisBloom to version 2.4.7 or 2.6.10 or later.
Who is affected by CVE-2024-25116?
CVE-2024-25116 affects authenticated users of RedisBloom versions between 2.0.0 and 2.4.7, and between 2.4.7 and 2.6.10.
What command triggers the vulnerability in CVE-2024-25116?
The `CF.RESERVE` command triggers the vulnerability in CVE-2024-25116.
What happens when CVE-2024-25116 is exploited?
Exploiting CVE-2024-25116 can lead to runtime assertion failures, causing the Redis server process to terminate.