Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. The problem is fixed in versions 7.0.12, 6.2.13, and 6.0.20.
CVSS Details
- CVSS 3.1 Base Score: 7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade redis-develUpgrade redisUpgrade redis-doc | Jan 24, 2025 | Jul 13, 2023 |
| Alpine Linux | — | Upgrade redis | Aug 22, 2024 | Jul 13, 2023 |
| Amazon Linux Ami 2 | — | Upgrade redis-debuginfoUpgrade redis-docUpgrade redis-develUpgrade redis | Sep 28, 2023 | Jul 13, 2023 |
| Amazon_linux_2023 | — | Upgrade redis6-docUpgrade redis6-debugsourceUpgrade redis6-develUpgrade redis6-debuginfoUpgrade redis6 | Feb 17, 2025 | Jul 10, 2023 |
| Debian | — | Upgrade redis | Feb 5, 2024 | Jul 13, 2023 |
| Freebsd | — | Upgrade redis60Upgrade redis62Upgrade redisUpgrade redis-devel | Jul 12, 2023 | Jul 10, 2023 |
| Gentoo Linux | — | Upgrade dev-db/redis. | Aug 8, 2024 | Jul 13, 2023 |
| Oracle_linux | — | Upgrade redis-docUpgrade redis-develUpgrade redis | Jan 24, 2025 | Jul 10, 2023 |
| Redhat_linux | — | Upgrade redis-develUpgrade redis-debugsourceUpgrade redisUpgrade redis-docUpgrade redis-debuginfo | Jan 23, 2025 | Jul 13, 2023 |
| Redislabs Redis | — | Upgrade RedisLabs Redis to version 6.2.13Upgrade RedisLabs Redis to version 7.0.12Upgrade RedisLabs Redis to version 6.0.20 | Oct 17, 2025 | Jul 13, 2023 |
| Rocky_linux | — | Upgrade redis-develUpgrade redis-debugsourceUpgrade redisUpgrade redis-debuginfo | Feb 14, 2025 | Jul 13, 2023 |
| Suse | — | Upgrade redis7Upgrade redis | Jul 21, 2023 | Jul 13, 2023 |
| Ubuntu | — | Upgrade redis (Ubuntu Pro)Upgrade liblua5.1-0-dev (Ubuntu Pro)Upgrade lua-cjson-dev (Ubuntu Pro)Upgrade liblua5.1-0 (Ubuntu Pro)Upgrade redisUpgrade lua-bitop-dev (Ubuntu Pro)Upgrade redis-sentinel (Ubuntu Pro)Upgrade redis-tools (Ubuntu Pro)Upgrade redis-sentinelUpgrade redis-toolsUpgrade liblua5.1-bitop-dev (Ubuntu Pro)Upgrade liblua5.1-bitop0 (Ubuntu Pro)Upgrade lua-bitop (Ubuntu Pro)Upgrade redis-serverUpgrade lua-cjson (Ubuntu Pro)Upgrade lua5.1 (Ubuntu Pro)Upgrade redis-server (Ubuntu Pro) | Dec 6, 2023 | Jul 13, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 13, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub