Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from processCommandAndResetClient when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.
Lua library commands may lead to stack overflow and RCE in Redis
Redis allows out of bounds writes in hyperloglog commands leading to RCE
Redis has been upgraded to version 7.0.15 to mitigate CVE-2023-41056.
Denial-of-service due to unbounded pattern matching in Redis
Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by SORTRO and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0 or newer and has been fixed in Redis 7.0.13 and 7.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2023-45145 - The wrong order of listen(2) and chmod(2) calls creates a race condition that can be used by another process to bypass desired Unix socket permissions on startup.
Upstream have released version 7.0.14/7.2.2 to fix CVE-2023-45145.
Reference: - https://github.com/redis/redis/releases/tag/7.0.14 - https://bugs.mageia.org/32406
Last updated 20 March 2025