Description
Buffer overflow in redis-cli of Redis before 4.0.10 and 5.x before 5.0 RC3 allows an attacker to achieve code execution and escalate to higher privileges via a crafted command line. NOTE: It is unclear whether there are any common situations in which redis-cli is used with, for example, a -h (aka hostname) argument from an untrusted source.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | redis | 5:4.0.10-1 | — |
| Debian 13 | redis | 5:4.0.10-1 | — |
| Debian 12 | redis | 5:4.0.10-1 | — |
| Debian 9 | redis | 3:3.2.6-3+deb9u1 | DSA-4230-1 |
| Debian 8 | redis | 2:2.8.17-1+deb8u6 | DLA-1396-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | redis | 5:4.0.9-1ubuntu0.1 | — |
| Ubuntu 16.04 LTS | redis | 2:3.0.6-1ubuntu0.2 | — |
| Ubuntu 14.04 LTS | redis | 2:2.8.4-2ubuntu0.2 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | rh-redis32-redis | 3.2.13-1.el6 | RHSA-2019:1860 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 13 | redis | 3.2.8-3.el7ost | RHSA-2019:0094 |
| Red Hat OpenStack 10 | redis | 3.0.6-4.el7ost | RHSA-2019:0052 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Redis-cli < 5.0 - Buffer Overflow (PoC) EDB-44904 · local · Jun 18, 2018
GitHub 1 repository
-
spasm5/CVE-2018-12326 ★ 0 · Mar 25, 2022
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 6
- RHSA-2019:1860 Red Hat Security Advisory: rh-redis32-redis security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2019:0052 Red Hat Security Advisory: redis security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2019:0094 Red Hat Security Advisory: redis security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- DSA-4230-1 redis - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1396-1 redis - security update Debian Security (DSA / DLA) · Mar 9, 2026
- ICSMA-21-187-01 Philips Vue PACS (Update B) CISA ICS & IT advisories · Apr 5, 2022
References
- https://gist.github.com/fakhrizulkifli/f831f40ec6cde4f744c552503d8698f0
- 44904 exploit
- RHSA-2019:0052 vendor-advisory
- RHSA-2019:0094 vendor-advisory
- https://github.com/antirez/redis/commit/9fdcc15962f9ff4baebe6fdd947816f43f730d50
- https://raw.githubusercontent.com/antirez/redis/4.0/00-RELEASENOTES
- https://raw.githubusercontent.com/antirez/redis/5.0/00-RELEASENOTES
- RHSA-2019:1860 vendor-advisory