CVE-2024-31449 — Improper Input Validation in Redis

CWE-20 — Improper Input ValidationCWE-121 — Stack-based Buffer OverflowCWE-787 — Out-of-bounds Write7 documents7 sources
Severity
8.8HIGHNVD
EPSS
58.2%
top 1.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
13
RedisLfprojects ValkeyDebian Redict+10 more
Timeline
PublishedOct 7
Latest updateApr 13

Description

Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages15 packages

▶NVDredis/redis2.8.18 — 6.2.16+2
▶debiandebian/redis< redict 7.3.1+ds-1 (forky)
▶Debianredis/redis< 5:7.0.15-1~deb12u2+2
▶CVEListV5redis/redis>= 2.6, < 6.2.16, >= 7.0.0, < 7.2.6, >= 7.3.0, < 7.4.1+2

Patches

Patch: github.com ↗

🔴Vulnerability Details

1
OSV
CVE-2024-31449: Redis is an open source, in-memory database that persists on disk↗2024-10-07
▶

🔍Detection Rules

1
Suricata
ET HUNTING Redis Authenticated Remote Code Execution in bit Library (CVE-2024-31449)↗2024-11-19
▶

📋Vendor Advisories

4
Ubuntu
Redis, Lua vulnerabilities↗2026-04-13
▶
Microsoft
Lua library commands may lead to stack overflow and RCE in Redis↗2024-10-08
▶
Red Hat
redis: Lua library commands may lead to stack overflow and RCE in Redis↗2024-10-07
▶
Debian
CVE-2024-31449: redict - Redis is an open source, in-memory database that persists on disk. An authentica...↗2024
▶