CVE-2023-41056CWE-190CWE-762

Redis vulnerable to integer overflow in certain payloads

High · published January 10, 2024

CVSS v3.1
8.1
EPSS
3%
Percentile
85.0
In the wild
Unconfirmed
What it is

Redis is an in-memory database that persists on disk. Redis incorrectly handles resizing of memory buffers which can result in integer overflow that leads to heap overflow and potential remote code execution. This issue has been patched in version 7.0.15 and 7.2.4.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02561 · 85.0th percentile
Weaknesses
CWE-190 · Integer Overflow or Wraparound; CWE-762 · Mismatched Memory Management Routines
Published
2024-01-10T15:59Z
EPSS history
Timeline
  • 10 JAN 15:59Z
    Redis vulnerable to integer overflow in certain payloads
    cvelistv5