CVE-2024-31449CWE-121CWE-20

Lua library commands may lead to stack overflow and RCE in Redis

High · published October 7, 2024

CVSS v3.1
7.0
EPSS
4%
Percentile
91.4
In the wild
Unconfirmed
What it is

Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.04458 · 91.4th percentile
Weaknesses
CWE-121 · Stack-based Buffer Overflow; CWE-20 · Improper Input Validation
Published
2024-10-07T19:51Z
EPSS history
Timeline
  • 07 OCT 19:51Z
    Lua library commands may lead to stack overflow and RCE in Redis
    cvelistv5