CVE-2024-25115CWE-120CWE-122

RedisBloom heap buffer overflow in CF.LOADCHUNK command

High · published April 9, 2024

CVSS v3.1
7.0
EPSS
0%
Percentile
35.5
In the wild
Unconfirmed
What it is

RedisBloom adds a set of probabilistic data structures to Redis. Starting in version 2.0.0 and prior to version 2.4.7 and 2.6.10, specially crafted `CF.LOADCHUNK` commands may be used by authenticated users to perform heap overflow, which may lead to remote code execution. The problem is fixed in RedisBloom 2.4.7 and 2.6.10.

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00422 · 35.5th percentile
Weaknesses
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'); CWE-122 · Heap-based Buffer Overflow
Published
2024-04-09T17:31Z
EPSS history
Timeline
  • 09 APR 17:31Z
    RedisBloom heap buffer overflow in CF.LOADCHUNK command
    cvelistv5