Skip to content
OpenAdvisories
High USN-7321-1 3 CVEs

redis vulnerabilities

Published Mar 5, 2025 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Redis incorrectly handled certain memory operations
during pattern matching. An attacker could possibly use this issue to cause
a denial of service. (CVE-2024-31228)

It was discovered that Redis incorrectly handled certain specially crafted
Lua scripts. An attacker could possibly use this issue to cause a denial
of service or execute arbitrary code. (CVE-2024-46981)

It was discovered that Redis incorrectly handled some malformed ACL
selectors. An attacker could possibly use this issue to cause a denial of
service. This issue only affected Ubuntu 24.10 and Ubuntu 24.04 LTS.
(CVE-2024-51741)

Fixed packages 6

ReleasePackageFixed in
Ubuntu · 24.04 LTS 24.04:LTS redis 5:7.0.15-1ubuntu0.24.04.1
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS redis 2:2.8.4-2ubuntu0.2+esm4
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS redis 2:3.0.6-1ubuntu0.4+esm3
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS redis 5:4.0.9-1ubuntu0.2+esm5
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS redis 5:5.0.7-2ubuntu0.1+esm3
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS redis 5:6.0.16-1ubuntu1+esm2

Vulnerabilities 3

  • High 7.0
    CVE-2024-46981 Public exploit

    Redis' Lua library commands may lead to remote code execution

    Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem is fixed in 7.4.2, 7.2.7, and 6.2.17…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • Medium 5.5
    CVE-2024-31228

    Denial-of-service due to unbounded pattern matching in Redis

    Redis is an open source, in-memory database that persists on disk. Authenticated users can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as `KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION LIST`, `COMMAND…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • Medium 4.4
    CVE-2024-51741

    Redis allows denial-of-service due to malformed ACL selectors

    Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem is fixed in Redis 7.…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine

References

  • report
    https://ubuntu.com/security/CVE-2024-31228
  • report
    https://ubuntu.com/security/CVE-2024-46981
  • report
    https://ubuntu.com/security/CVE-2024-51741