CVE-2023-28856mediumCWE-20CWE-617

CVE-2023-28856: medium-severity vulnerability in redis

`HINCRBYFLOAT` can be used to crash a redis-server process

Published · Updated

Follow this CVE+ Monitor redis+ Monitor redis

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.5epss 1.3%
Redis is an open source, in-memory database that persists on disk. Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that will crash Redis on access in affected versions. This issue has been addressed in in versions 7.0.11, 6.2.12, and 6.0.19. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
redis · redis
Related CVEs — redis

In the same product, most dangerous first.

CVE-2025-49844CRITICALRedis Lua Use-After-Free may lead to remote code executionEPSS 82.6%CVE-2023-36824HIGHHeap overflow in COMMAND GETKEYS and ACL evaluation in RedisEPSS 77.4%CVE-2023-22458MEDIUMInteger overflow in multiple Redis commands can lead to denial-of-serviceEPSS 72.0%CVE-2022-36021MEDIUMRedis string pattern matching can be abused to achieve Denial of ServiceEPSS 59.8%CVE-2023-28425MEDIUMSpecially crafted MSETNX command can lead to denial-of-serviceEPSS 58.5%CVE-2022-24834HIGHHeap overflow issue with the Lua cjson library used by RedisEPSS 41.4%