CVE-2024-31449highCWE-121CWE-20

CVE-2024-31449: falha de alta gravidade em redis

Lua library commands may lead to stack overflow and RCE in Redis

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar redis+ Monitorar redis

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7epss 4.5%
Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
redis · redis
CVEs relacionadas — redis

No mesmo produto, das mais perigosas para as menos.

CVE-2025-49844CRITICALRedis Lua Use-After-Free may lead to remote code executionEPSS 82.6%CVE-2023-36824HIGHHeap overflow in COMMAND GETKEYS and ACL evaluation in RedisEPSS 77.4%CVE-2023-22458MEDIUMInteger overflow in multiple Redis commands can lead to denial-of-serviceEPSS 72.0%CVE-2022-36021MEDIUMRedis string pattern matching can be abused to achieve Denial of ServiceEPSS 59.8%CVE-2023-28425MEDIUMSpecially crafted MSETNX command can lead to denial-of-serviceEPSS 58.5%CVE-2022-24834HIGHHeap overflow issue with the Lua cjson library used by RedisEPSS 41.4%