Redis is an in-memory database that persists on disk. Authenticated users can issue a `HRANDFIELD` or `ZRANDMEMBER` command with specially crafted arguments to trigger a denial-of-service by crashing Redis with an assertion failure. This problem affects Redis versions 6.2 or newer up to but not including 6.2.9 as well as versions 7.0 up to but not including 7.0.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade redis-develUpgrade redis-docUpgrade redis | Jan 24, 2025 | Jan 20, 2023 |
| Alpine Linux | — | Upgrade redis | Aug 22, 2024 | Jan 20, 2023 |
| Amazon Linux Ami 2 | — | Upgrade redis-docUpgrade redis-develUpgrade redis-debuginfoUpgrade redis | Sep 28, 2023 | Jan 20, 2023 |
| Debian | — | Upgrade redis | Jul 30, 2024 | Jan 20, 2023 |
| Freebsd | — | Upgrade redisUpgrade redis6Upgrade redis-develUpgrade redis62 | Jan 18, 2023 | Jan 16, 2023 |
| Gentoo Linux | — | Upgrade dev-db/redis. | Aug 8, 2024 | Jan 20, 2023 |
| Oracle_linux | — | Upgrade redis-develUpgrade redisUpgrade redis-doc | Jan 24, 2025 | Jan 17, 2023 |
| Redhat_linux | — | No solution existsUpgrade redis-docUpgrade redis-debuginfoUpgrade redis-develUpgrade redis-debugsourceUpgrade redis | Jan 23, 2025 | Jan 20, 2023 |
| Redislabs Redis | — | Upgrade RedisLabs Redis to version 6.2.9Upgrade RedisLabs Redis to version 7.0.8 | Oct 17, 2025 | Jan 20, 2023 |
| Rocky_linux | — | Upgrade redisUpgrade redis-debugsourceUpgrade redis-debuginfoUpgrade redis-devel | Feb 14, 2025 | Jan 20, 2023 |
| Suse | — | Upgrade redis | Feb 8, 2023 | Jan 20, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jan 20, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub