CVE-2024-31228: Denial-of-service due to unbounded pattern matching in Redis
Denial-of-service due to unbounded pattern matching in Redis
Other sources
Redis is an open source, in-memory database that persists on disk. Authenticated users can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as KEYS, SCAN, PSUBSCRIBE, FUNCTION LIST, COMMAND LIST and ACL definitions. Matching of extremely long patterns may result in unbounded recursion, leading to stack overflow and process crash. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-31228?
CVE-2024-31228 is classified as a denial-of-service vulnerability.
How do I fix CVE-2024-31228?
To mitigate CVE-2024-31228, upgrade Redis to a version later than 6.2.16, 7.2.6, or 7.4.1.
Who is affected by CVE-2024-31228?
CVE-2024-31228 affects Redis versions prior to 6.2.16, 7.2.6, and 7.4.1.
What commands are impacted by CVE-2024-31228?
Commands such as KEYS, SCAN, PSUBSCRIBE, FUNCTION LIST, COMMAND LIST, and ACL definition are impacted by CVE-2024-31228.
How can users exploit CVE-2024-31228?
Authenticated users can exploit CVE-2024-31228 by sending specially crafted, long string match patterns to trigger a denial-of-service.