CVE-2024-51480CWE-122CWE-190

RedisTimeSeries Integer Overflow Remote Code Execution Vulnerability

High · published January 8, 2025

CVSS v3.1
7.0
EPSS
0%
Percentile
9.6
In the wild
Unconfirmed
What it is

RedisTimeSeries is a time-series database (TSDB) module for Redis, by Redis. Executing one of these commands TS.QUERYINDEX, TS.MGET, TS.MRAGE, TS.MREVRANGE by an authenticated user, using specially crafted command arguments may cause an integer overflow, a subsequent heap overflow, and potentially lead to remote code execution. This vulnerability is fixed in 1.6.20, 1.8.15, 1.10.15, and 1.12.3.

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00202 · 9.6th percentile
Weaknesses
CWE-122 · Heap-based Buffer Overflow; CWE-190 · Integer Overflow or Wraparound
Published
2025-01-08T15:20Z
EPSS history
Timeline
  • 08 JAN 15:20Z
    RedisTimeSeries Integer Overflow Remote Code Execution Vulnerability
    cvelistv5