IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
4.7Mittel

CVE-2025-27151redis-check-aof may lead to stack overflow and potential RCE

redis redis Veröffentlicht: (vor 1 Jahr)

Beschreibung

Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a stack-based buffer overflow exists in redis-check-aof due to the use of memcpy with strlen(filepath) when copying a user-supplied file path into a fixed-size stack buffer. This allows an attacker to overflow the stack and potentially achieve code execution. This issue has been patched in version 8.0.2.

Schwachstellentyp (CWE): CWE-20CWE-121

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
redis redis >= 7.0.0, < 8.0.2

Referenzen und Patches

CPE-Treffer (NVD) (3)
  • cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:* ≥ 7.0.0 < 7.2.9
  • cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:* ≥ 7.4.0 < 7.4.4
  • cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:* ≥ 8.0.0 < 8.0.2

Neue CVEs im selben Produkt — Redis

7.1Hoch
CVE-2026-81934

Redis TLS pending-data list use-after-free

Redis Redis; Redis Redis Software (Enterprise)

Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the pri…

7.5Hoch
CVE-2026-66373
Redis Redis

Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XG…

7.7Hoch
CVE-2026-25243

redis-server RESTORE invalid memory access may allow remote code execution

redis redis; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 8

Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that tr…

4.0%EPSS
6.1Mittel
CVE-2026-23631

redis-server Lua use-after-free may allow remote code execution

redis redis; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 9

Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or c…

3.1%EPSS
7.7Hoch
CVE-2026-23479

redis-server use-after-free in unblock client flow may allow remote code execution

redis redis; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 9

Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flo…

2.6%EPSS