IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
4.7Orta

CVE-2025-27151redis-check-aof may lead to stack overflow and potential RCE

redis redis Yayım: (1 yıl önce)

Açıklama

Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a stack-based buffer overflow exists in redis-check-aof due to the use of memcpy with strlen(filepath) when copying a user-supplied file path into a fixed-size stack buffer. This allows an attacker to overflow the stack and potentially achieve code execution. This issue has been patched in version 8.0.2.

Zayıflık türü (CWE): CWE-20CWE-121

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
redis redis >= 7.0.0, < 8.0.2

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (3)
  • cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:* ≥ 7.0.0 < 7.2.9
  • cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:* ≥ 7.4.0 < 7.4.4
  • cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:* ≥ 8.0.0 < 8.0.2

Aynı üründe son açıklar — Redis

7.1Yüksek
CVE-2026-81934

Redis TLS pending-data list use-after-free

Redis Redis; Redis Redis Software (Enterprise)

Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the pri…

7.5Yüksek
CVE-2026-66373
Redis Redis

Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XG…

7.7Yüksek
CVE-2026-25243

redis-server RESTORE invalid memory access may allow remote code execution

redis redis; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 8

Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that tr…

4.0%EPSS
6.1Orta
CVE-2026-23631

redis-server Lua use-after-free may allow remote code execution

redis redis; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 9

Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or c…

3.1%EPSS
7.7Yüksek
CVE-2026-23479

redis-server use-after-free in unblock client flow may allow remote code execution

redis redis; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 9

Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flo…

2.6%EPSS