CVE-2023-28856CWE-20CWE-617

`HINCRBYFLOAT` can be used to crash a redis-server process

Medium · published April 18, 2023

CVSS v3.1
5.5
EPSS
1%
Percentile
69.3
In the wild
Unconfirmed
What it is

Redis is an open source, in-memory database that persists on disk. Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that will crash Redis on access in affected versions. This issue has been addressed in in versions 7.0.11, 6.2.12, and 6.0.19. Users are advised to upgrade. There are no known workarounds for this issue.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01256 · 69.3th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-617 · Reachable Assertion
Published
2023-04-18T20:50Z
EPSS history
Timeline
  • 18 APR 20:50Z
    `HINCRBYFLOAT` can be used to crash a redis-server process
    cvelistv5