Debian Redis vulnerabilities

CVE-2022-0543 [CRITICAL] CWE-862 CVE-2022-0543: It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone t It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.

CVE-2025-49844 [CRITICAL] CVE-2025-49844: redict - Redis is an open source, in-memory database that persists on disk. Versions 8.2.... Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2

CVE-2018-11218 [CRITICAL] CVE-2018-11218: redis - Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in... Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer overflows. Scope: local bookworm: resolved (fixed in 5:4.0.10-1) bullseye: resolved (fixed in 5:4.0.10-1) forky: resolved (fixed in 5:4.0.10-1) sid: resolved (fixed in 5:4.0.10-1) trixie: reso

CVE-2025-46817 [HIGH] CVE-2025-46817: redict - Redis is an open source, in-memory database that persists on disk. Versions 8.2.... Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. Scope: local forky: resolved (fixe

CVE-2023-36824 [HIGH] CVE-2023-36824: redis - Redis is an in-memory database that persists on disk. In Redit 7.0 prior to 7.0.... Redis is an in-memory database that persists on disk. In Redit 7.0 prior to 7.0.12, extracting key names from a command and a list of arguments may, in some cases, trigger a heap overflow and result in reading random heap memory, heap corruption and potentially remote code execution. Several scenarios that may lead to authenticated users executing a specially crafted

CVE-2022-24834 [HIGH] CVE-2022-24834: redis - Redis is an in-memory database that persists on disk. A specially crafted Lua sc... Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. T

CVE-2025-32023 [HIGH] CVE-2025-32023: redict - Redis is an open source, in-memory database that persists on disk. From 2.8 to b... Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially leading to remote code execution. The bug likely affects all Redis versions with hyperloglog operations imple

CVE-2018-12326 [HIGH] CVE-2018-12326: redis - Buffer overflow in redis-cli of Redis before 4.0.10 and 5.x before 5.0 RC3 allow... Buffer overflow in redis-cli of Redis before 4.0.10 and 5.x before 5.0 RC3 allows an attacker to achieve code execution and escalate to higher privileges via a crafted command line. NOTE: It is unclear whether there are any common situations in which redis-cli is used with, for example, a -h (aka hostname) argument from an untrusted source. Scope: local bookworm: reso

CVE-2021-32626 [HIGH] CVE-2021-32626: redis - Redis is an open source, in-memory database that persists on disk. In affected v... Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted Lua scripts executing in Redis can cause the heap-based Lua stack to be overflowed, due to incomplete checks for this condition. This can result with heap corruption and potentially remote code execution. This problem exists in all versions of Redis with Lua scrip

CVE-2025-46818 [MEDIUM] CVE-2025-46818: redict - Redis is an open source, in-memory database that persists on disk. Versions 8.2.... Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. The problem exists in all versions of Redis with LUA scripting. This issue is fixed in version 8.2.2. A wo

CVE-2021-32761 [HIGH] CVE-2021-32761: redis - Redis is an in-memory database that persists on disk. A vulnerability involving ... Redis is an in-memory database that persists on disk. A vulnerability involving out-of-bounds read and integer overflow to buffer overflow exists starting with version 2.2 and prior to versions 5.0.13, 6.0.15, and 6.2.5. On 32-bit systems, Redis `*BIT*` command are vulnerable to integer overflow that can potentially be exploited to corrupt the heap, leak arbitrary hea

CVE-2024-46981 [HIGH] CVE-2024-46981: redict - Redis is an open source, in-memory database that persists on disk. An authentica... Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem is fixed in 7.4.2, 7.2.7, and 6.2.17. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent

CVE-2016-8339 [CRITICAL] CVE-2016-8339: redis - A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution ... A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. An out of bounds write vulnerability exists in the handling of the client-output-buffer-limit option during the CONFIG SET command for the Redis data structure store. A crafted CONFIG SET command can lead to an out of bounds write potentially resulting in

CVE-2015-4335 [CRITICAL] CVE-2015-4335: redis - Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbi... Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command. Scope: local bookworm: resolved (fixed in 2:3.0.2-1) bullseye: resolved (fixed in 2:3.0.2-1) forky: resolved (fixed in 2:3.0.2-1) sid: resolved (fixed in 2:3.0.2-1) trixie: resolved (fixed in 2:3.0.2-1)

CVE-2024-31449 [HIGH] CVE-2024-31449: redict - Redis is an open source, in-memory database that persists on disk. An authentica... Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.

CVE-2022-35951 [HIGH] CVE-2022-35951: redis - Redis is an in-memory database that persists on disk. Versions 7.0.0 and above, ... Redis is an in-memory database that persists on disk. Versions 7.0.0 and above, prior to 7.0.5 are vulnerable to an Integer Overflow. Executing an `XAUTOCLAIM` command on a stream key in a specific state, with a specially crafted `COUNT` argument may cause an integer overflow, a subsequent heap overflow, and potentially lead to remote code execution. This has been pat

CVE-2021-32628 [HIGH] CVE-2021-32628: redis - Redis is an open source, in-memory database that persists on disk. An integer ov... Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the ziplist data structure used by all versions of Redis can be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves modifying the default ziplist configuration parameters (hash-max-ziplist-entries, hash-max-ziplist-value

CVE-2025-46819 [MEDIUM] CVE-2025-46819: redict - Redis is an open source, in-memory database that persists on disk. Versions 8.2.... Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue wi

CVE-2019-10192 [HIGH] CVE-2019-10192: redis - A heap-buffer overflow vulnerability was found in the Redis hyperloglog data str... A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By carefully corrupting a hyperloglog using the SETRANGE command, an attacker could trick Redis interpretation of dense HLL encoding to write up to 3 bytes beyond the end of a heap-allocated buffer. Scope: local boo

CVE-2021-21309 [MEDIUM] CVE-2021-21309: redis - Redis is an open-source, in-memory database that persists on disk. In affected v... Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and potentially result with remote code execution. Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is