Description
Integer overflow in the getnum function in lua_struct.c in Redis 2.8.x before 2.8.24 and 3.0.x before 3.0.6 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number, which triggers a stack-based buffer overflow.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | redis | 2:3.0.5-4 | — |
| Debian 13 | redis | 2:3.0.5-4 | — |
| Debian 12 | redis | 2:3.0.5-4 | — |
| Debian 8 | redis | 2:2.8.17-1+deb8u3 | DSA-3412-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | redis | 2:2.8.4-2ubuntu0.2 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Openstack-optools 7 | redis | 2.8.24-1.el7ost | RHSA-2016:0097 |
| Red Hat OpenStack 7 | redis | 2.8.24-1.el7ost | RHSA-2016:0096 |
| Red Hat OpenStack 6 | redis | 2.8.24-1.el7ost | RHSA-2016:0095 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP2 | redis | 6.0.8-1.3.1 | SUSE-OU-2020:3291-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | redis | 6.2.5-1.2 | openSUSE-SU-2024:11299-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | redis | 5.0.8-r0 | — |
| Alpine v3.23 | redis | 5.0.8-r0 | — |
| Alpine v3.22 | redis | 5.0.8-r0 | — |
| Alpine v3.21 | redis | 5.0.8-r0 | — |
| Alpine v3.20 | redis | 5.0.8-r0 | — |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | redis | 5.0.8-r0 | — |
| Alpine v3.18 | redis | 5.0.8-r0 | — |
| Alpine v3.17 | redis | 5.0.8-r0 | — |
| Alpine v3.16 | redis | 5.0.8-r0 | — |
| Alpine v3.15 | redis | 5.0.8-r0 | — |
| Alpine v3.14 | redis | 5.0.8-r0 | — |
| Alpine v3.13 | redis | 5.0.8-r0 | — |
| Alpine v3.12 | redis | 5.0.8-r0 | — |
| Alpine v3.11 | redis | 5.0.7-r1 | — |
| Alpine v3.10 | redis | 5.0.5-r1 | — |
Advisories 6
- RHSA-2016:0096 Red Hat Security Advisory: redis security advisory Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2016:0097 Red Hat Security Advisory: redis security advisory Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2016:0095 Red Hat Security Advisory: redis security advisory Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-3412-1 redis - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11299-1 redis-6.2.5-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-OU-2020:3291-1 Optional update for python-redis and redis SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://raw.githubusercontent.com/antirez/redis/2.8/00-RELEASENOTES
- openSUSE-SU-2016:1444 vendor-advisory
- RHSA-2016:0097 vendor-advisory
- https://raw.githubusercontent.com/antirez/redis/3.0/00-RELEASENOTES
- DSA-3412 vendor-advisory
- RHSA-2016:0095 vendor-advisory
- [oss-security] 20151106 Review+CVE request: multiple issues in redis EVAL command (lua sandbox) mailing-list
- 77507 vdb-entry
- https://github.com/antirez/redis/issues/2855
- RHSA-2016:0096 vendor-advisory
- GLSA-201702-16 vendor-advisory
- [oss-security] 20151106 Re: Review+CVE request: multiple issues in redis EVAL command (lua sandbox) mailing-list