Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. The problem is fixed in versions 7.0.12, 6.2.13, and 6.0.20.
CVSS Details
- CVSS 3.1 Base Score: 7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade redis-docUpgrade redis-develUpgrade redis | Jan 24, 2025 | Jul 13, 2023 |
| Alpine Linux | — | Upgrade redis | Aug 22, 2024 | Jul 13, 2023 |
| Amazon Linux Ami 2 | — | Upgrade redis-docUpgrade redis-debuginfoUpgrade redisUpgrade redis-devel | Sep 28, 2023 | Jul 13, 2023 |
| Amazon_linux_2023 | — | Upgrade redis6Upgrade redis6-debuginfoUpgrade redis6-debugsourceUpgrade redis6-develUpgrade redis6-doc | Feb 17, 2025 | Jul 10, 2023 |
| Debian | — | Upgrade redis | Feb 5, 2024 | Jul 13, 2023 |
| Freebsd | — | Upgrade redisUpgrade redis-develUpgrade redis60Upgrade redis62 | Jul 12, 2023 | Jul 10, 2023 |
| Gentoo Linux | — | Upgrade dev-db/redis. | Aug 8, 2024 | Jul 13, 2023 |
| Oracle_linux | — | Upgrade redis-docUpgrade redisUpgrade redis-devel | Jan 24, 2025 | Jul 10, 2023 |
| Redhat_linux | — | Upgrade redis-debugsourceUpgrade redis-docUpgrade redisUpgrade redis-debuginfoUpgrade redis-devel | Jan 23, 2025 | Jul 13, 2023 |
| Redislabs Redis | — | Upgrade RedisLabs Redis to version 6.0.20Upgrade RedisLabs Redis to version 7.0.12Upgrade RedisLabs Redis to version 6.2.13 | Oct 17, 2025 | Jul 13, 2023 |
| Rocky_linux | — | Upgrade redis-debuginfoUpgrade redis-debugsourceUpgrade redisUpgrade redis-devel | Feb 14, 2025 | Jul 13, 2023 |
| Suse | — | Upgrade redis7Upgrade redis | Jul 21, 2023 | Jul 13, 2023 |
| Ubuntu | — | Upgrade lua5.1 (Ubuntu Pro)Upgrade lua-cjson (Ubuntu Pro)Upgrade redis-serverUpgrade lua-bitop (Ubuntu Pro)Upgrade redis-server (Ubuntu Pro)Upgrade liblua5.1-0 (Ubuntu Pro)Upgrade redisUpgrade redis (Ubuntu Pro)Upgrade redis-sentinel (Ubuntu Pro)Upgrade liblua5.1-bitop-dev (Ubuntu Pro)Upgrade lua-bitop-dev (Ubuntu Pro)Upgrade redis-toolsUpgrade redis-tools (Ubuntu Pro)Upgrade liblua5.1-bitop0 (Ubuntu Pro)Upgrade redis-sentinelUpgrade lua-cjson-dev (Ubuntu Pro)Upgrade liblua5.1-0-dev (Ubuntu Pro) | Dec 6, 2023 | Jul 13, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 13, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub