CVE-2024-31228

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-31228

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

R

edis is an open source, in-memory database that persists on disk. Authenticated users can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as `KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION LIST`, `COMMAND LIST` and ACL definitions. Matching of extremely long patterns may result in unbounded recursion, leading to stack overflow and process crash. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

References
Link Resource
https://github.com/redis/redis/commit/9317bf64659b33166a943ec03d5d9b954e86afb0 Patch
https://github.com/redis/redis/security/advisories/GHSA-66gq-c942-6976 Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/11/msg00031.html
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*
cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*
cpe:2.3:a:redis:redis:7.4.0:-:*:*:*:*:*:*
cpe:2.3:a:redis:redis:7.4.0:rc1:*:*:*:*:*:*
cpe:2.3:a:redis:redis:7.4.0:rc2:*:*:*:*:*:*
History

03 Nov 2025, 22:16

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/11/msg00031.html -

04 Sep 2025, 19:10

Type Values Removed Values Added
First Time Redis
Redis redis
CPE cpe:2.3:a:redis:redis:7.4.0:rc1:*:*:*:*:*:*
cpe:2.3:a:redis:redis:7.4.0:rc2:*:*:*:*:*:*
cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*
cpe:2.3:a:redis:redis:7.4.0:-:*:*:*:*:*:*
References () https://github.com/redis/redis/commit/9317bf64659b33166a943ec03d5d9b954e86afb0 - () https://github.com/redis/redis/commit/9317bf64659b33166a943ec03d5d9b954e86afb0 - Patch
References () https://github.com/redis/redis/security/advisories/GHSA-66gq-c942-6976 - () https://github.com/redis/redis/security/advisories/GHSA-66gq-c942-6976 - Vendor Advisory

10 Oct 2024, 12:57

Type Values Removed Values Added
Summary
  • (es) Redis es una base de datos de código abierto en memoria que persiste en el disco. Los usuarios autenticados pueden desencadenar una denegación de servicio mediante el uso de patrones de coincidencia de cadenas largas especialmente manipulados en comandos compatibles, como `KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION LIST`, `COMMAND LIST` y definiciones de ACL. La coincidencia de patrones extremadamente largos puede provocar una recursión sin límites, lo que lleva a un desbordamiento de pila y un bloqueo del proceso. Este problema se ha solucionado en las versiones 6.2.16, 7.2.6 y 7.4.1 de Redis. Se recomienda a los usuarios que actualicen la versión. No existen workarounds conocidas para esta vulnerabilidad.

07 Oct 2024, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-07 20:15

Updated : 2025-11-03 22:16

NVD link : CVE-2024-31228

Mitre link : CVE-2024-31228

CVE.ORG link : CVE-2024-31228

JSON object : View

Products Affected

redis

CWE
CWE-674

Uncontrolled Recursion