IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
7.4Yüksek

CVE-2023-36824Heap overflow in COMMAND GETKEYS and ACL evaluation in Redis

redis redis Yayım: (3 yıl önce)

Açıklama

Redis is an in-memory database that persists on disk. In Redit 7.0 prior to 7.0.12, extracting key names from a command and a list of arguments may, in some cases, trigger a heap overflow and result in reading random heap memory, heap corruption and potentially remote code execution. Several scenarios that may lead to authenticated users executing a specially crafted `COMMAND GETKEYS` or `COMMAND GETKEYSANDFLAGS`and authenticated users who were set with ACL rules that match key names, executing a specially crafted command that refers to a variadic list of key names. The vulnerability is patched in Redis 7.0.12.

Zayıflık türü (CWE): CWE-122CWE-131

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
redis redis >= 7.0.0, < 7.0.12

Kaynaklar ve yamalar

Aynı üründe son açıklar — Redis

7.1Yüksek
CVE-2026-81934

Redis TLS pending-data list use-after-free

Redis Redis; Redis Redis Software (Enterprise)

Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the pri…

7.5Yüksek
CVE-2026-66373
Redis Redis

Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XG…

7.7Yüksek
CVE-2026-25243

redis-server RESTORE invalid memory access may allow remote code execution

redis redis; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 8

Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that tr…

4.0%EPSS
6.1Orta
CVE-2026-23631

redis-server Lua use-after-free may allow remote code execution

redis redis; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 9

Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or c…

3.1%EPSS
7.7Yüksek
CVE-2026-23479

redis-server use-after-free in unblock client flow may allow remote code execution

redis redis; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 9

Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flo…

2.6%EPSS