CVE-2024-51741 — Improper Input Validation in Redis

CWE-20 — Improper Input Validation9 documents6 sources
Severity
4.4MEDIUMNVD
OSV9.8OSV6.5
EPSS
0.5%
top 32.70%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
RedisLfprojects ValkeyDebian Redict+4 more
Timeline
PublishedJan 6
Latest updateMar 19

Description

Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem is fixed in Redis 7.2.7 and 7.4.2.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HExploitability: 0.8 | Impact: 3.6

Affected Packages11 packages

▶NVDredis/redis7.0.0 — 7.2.7+1
▶debiandebian/redis< redict 7.3.2+ds-1 (forky)
▶Debianredis/redis< 5:7.0.15-1~deb12u3+2
▶Ubunturedis/redis< 5:7.0.15-1ubuntu0.24.04.1+5
▶CVEListV5redis/redis>= 7.0.0, < 7.2.7, >= 7.4.0, < 7.4.2+1

🔴Vulnerability Details

3
OSV
valkey vulnerabilities↗2025-03-19
▶
OSV
redis vulnerabilities↗2025-03-05
▶
OSV
CVE-2024-51741: Redis is an open source, in-memory database that persists on disk↗2025-01-06
▶

📋Vendor Advisories

5
Ubuntu
Valkey vulnerabilities↗2025-03-19
▶
Ubuntu
Redis vulnerabilities↗2025-03-05
▶
Microsoft
Redis allows denial-of-service due to malformed ACL selectors↗2025-01-14
▶
Red Hat
redis: Redis allows denial-of-service due to malformed ACL selectors↗2025-01-06
▶
Debian
CVE-2024-51741: redict - Redis is an open source, in-memory database that persists on disk. An authentica...↗2024
▶
CVE-2024-51741 — Improper Input Validation in Redis | cvebase