Redis is an in-memory database that persists on disk. Prior to versions 6.2.7 and 7.0.0, an attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result with a crash of the redis-server process. The problem is fixed in Redis versions 7.0.0 and 6.2.7. An additional workaround to mitigate this problem without patching the redis-server executable, if Lua scripting is not being used, is to block access to `SCRIPT LOAD` and `EVAL` commands using ACL rules.
CVSS Details
- CVSS 3.1 Base Score: 3.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade redisUpgrade redis-docUpgrade redis-devel | Nov 14, 2022 | Apr 27, 2022 |
| Alpine Linux | — | Upgrade redis | Mar 26, 2024 | Apr 27, 2022 |
| Amazon Linux Ami 2 | — | Upgrade redis-debuginfoUpgrade redis-docUpgrade redisUpgrade redis-devel | Sep 28, 2023 | Apr 27, 2022 |
| Amazon_linux_2023 | — | Upgrade redis6-docUpgrade redis6-debugsourceUpgrade redis6Upgrade redis6-debuginfoUpgrade redis6-devel | Feb 17, 2025 | Apr 27, 2022 |
| Centos_linux | — | Upgrade redisUpgrade redis-debugsourceUpgrade redis-develUpgrade redis-debuginfoUpgrade redis-doc | Nov 9, 2022 | Apr 27, 2022 |
| Debian | — | Upgrade redis | Jul 30, 2024 | Apr 27, 2022 |
| Freebsd | — | Upgrade redis-develUpgrade redis62Upgrade redis | Nov 4, 2022 | Apr 27, 2022 |
| Gentoo Linux | — | Upgrade dev-db/redis. | Sep 30, 2022 | Apr 27, 2022 |
| Oracle_linux | — | Upgrade redis-docUpgrade redisUpgrade redis-devel | Nov 16, 2022 | Apr 27, 2022 |
| Redhat_linux | — | Upgrade redis-debugsourceUpgrade redis-docUpgrade redis-debuginfoNo solution existsUpgrade redisUpgrade redis-devel | Nov 9, 2022 | Apr 27, 2022 |
| Redislabs Redis | — | Upgrade RedisLabs Redis to version 6.2.7Upgrade RedisLabs Redis to the latest version | Oct 17, 2025 | Apr 27, 2022 |
| Rocky_linux | — | Upgrade redis-debuginfoUpgrade redis-debugsourceUpgrade redis-develUpgrade redis | Mar 12, 2024 | Apr 27, 2022 |
| Suse | — | Upgrade redis | Oct 26, 2022 | Apr 27, 2022 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Apr 27, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 27, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub