Vendor
Redis
55 known vulnerabilities.
6 results · Clear filters · Feed
-
Low 3.5
Redis through 8.0.3 allows memory consumption via a multi-bulk command composed of many bulks, sent by an authenticated…
-
Low 3.7
go-redis allows potential out of order responses when `CLIENT SETINFO` times out during connection establishment
go-redis is the official Redis client library for the Go programming language. Prior to 9.5.5, 9.6.3, and 9.7.2, go-redis potentially responds out of order when `CLIENT SETINFO` times out during connection establishment. This can happen when the client is con…
-
Low 3.6
Redis Unix-domain socket may have be exposed with the wrong permissions for a short time window.
Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during…
-
Low 3.3
Redis SORT_RO may bypass ACL configuration
Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by `SORT_RO` and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem e…
-
Low 3.3
A Malformed Lua script can crash Redis
Redis is an in-memory database that persists on disk. Prior to versions 6.2.7 and 7.0.0, an attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result with a crash of the redis-server process. The problem i…
-
Low 3.9
Lua scripts can be manipulated to overcome ACL rules in Redis
Redis is an in-memory database that persists on disk. By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis prior to version 7.0.0 or 6.2.7 can inject Lua code that will execute with the (potentially higher) privil…