Description
A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By carefully corrupting a hyperloglog using the SETRANGE command, an attacker could trick Redis interpretation of dense HLL encoding to write up to 3 bytes beyond the end of a heap-allocated buffer.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Redis Labs | redis | 3.x before 3.2.13, 4.x before 4.0.14, 5.x before 5.0.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | redis | 5:5.0.4-1 | — |
| Debian 13 | redis | 5:5.0.4-1 | — |
| Debian 12 | redis | 5:5.0.4-1 | — |
| Debian 10 | redis | 5:5.0.3-4+deb10u1 | DSA-4480-1 |
| Debian 9 | redis | 3:3.2.6-3+deb9u3 | DSA-4480-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | redis | 2:2.8.17-1+deb8u7 | DLA-1850-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | redis | 5:4.0.9-1ubuntu0.2 | USN-4061-1 |
| Ubuntu 16.04 LTS | redis | 2:3.0.6-1ubuntu0.4 | USN-4061-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | redis +2 | 5.0.3-2.module+el8.0.0.z+3657+acb471dc | RHSA-2019:2002 |
| RHEL 3 | rh-redis32-redis | 3.2.13-1.el6 | RHSA-2019:1860 |
| RHEL 3 | rh-redis5-redis | 5.0.5-1.el7 | RHSA-2019:1819 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Openstack-optools 9 | redis | 3.0.6-5.el7ost | RHSA-2019:2506 |
| Red Hat OpenStack 14 | redis | 3.2.8-4.el7ost | RHSA-2019:2621 |
| Red Hat OpenStack 13 | redis | 3.2.8-4.el7ost | RHSA-2019:2628 |
| Red Hat OpenStack 10 | redis | 3.0.6-5.el7ost | RHSA-2019:2630 |
| Red Hat OpenStack 9 | redis | 3.0.6-5.el7ost | RHSA-2019:2508 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | redis | 5.0.3-2.module+el8.4.0+393+5af13779 | RLSA-2019:2002 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | redis | 5.0.4-r0 | — |
| Alpine v3.23 | redis | 5.0.4-r0 | — |
| Alpine v3.22 | redis | 5.0.4-r0 | — |
| Alpine v3.21 | redis | 5.0.4-r0 | — |
| Alpine v3.20 | redis | 5.0.4-r0 | — |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | redis | 5.0.4-r0 | — |
| Alpine v3.18 | redis | 5.0.4-r0 | — |
| Alpine v3.17 | redis | 5.0.4-r0 | — |
| Alpine v3.16 | redis | 5.0.4-r0 | — |
| Alpine v3.15 | redis | 5.0.4-r0 | — |
| Alpine v3.14 | redis | 5.0.4-r0 | — |
| Alpine v3.13 | redis | 5.0.4-r0 | — |
| Alpine v3.12 | redis | 5.0.4-r0 | — |
| Alpine v3.11 | redis | 5.0.4-r0 | — |
| Alpine v3.10 | redis | 5.0.4-r0 | — |
| Alpine v3.9 | redis | 4.0.14-r0 | — |
| Alpine v3.8 | redis | 4.0.14-r0 | — |
| Alpine v3.7 | redis | 4.0.14-r0 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | redis +2 | 5.0.3-2.module+el8.0.0.z+5250+19ca22c8 | ELSA-2019-2002 |
Advisories 14
- WID-SEC-2022-0517 Red Hat Enterprise Linux: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 18, 2026
- RHSA-2019:1860 Red Hat Security Advisory: rh-redis32-redis security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2019:2628 Red Hat Security Advisory: redis security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2019:2630 Red Hat Security Advisory: redis security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2019:2621 Red Hat Security Advisory: redis security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2019:2508 Red Hat Security Advisory: redis security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2019:2506 Red Hat Security Advisory: redis security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2019:2002 Red Hat Security Advisory: redis:5 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2019:1819 Red Hat Security Advisory: rh-redis5-redis security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-4480-1 redis - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1850-1 redis - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-4061-1 redis vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- RLSA-2019:2002 Important: redis:5 security update Rocky Linux Security Advisories · Feb 4, 2026
- ELSA-2019-2002 Important: redis:5 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 19, 2019
References
- DSA-4480 vendor-advisory
- 20190712 [SECURITY] [DSA 4480-1] redis security update mailing-list
- USN-4061-1 vendor-advisory
- 109290 vdb-entry
- RHSA-2019:1819 vendor-advisory
- RHSA-2019:1860 vendor-advisory
- RHSA-2019:2002 vendor-advisory
- GLSA-201908-04 vendor-advisory
- RHSA-2019:2508 vendor-advisory
- RHSA-2019:2506 vendor-advisory
- RHSA-2019:2621 vendor-advisory
- RHSA-2019:2630 vendor-advisory
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://raw.githubusercontent.com/antirez/redis/3.2/00-RELEASENOTES
- https://raw.githubusercontent.com/antirez/redis/4.0/00-RELEASENOTES
- https://raw.githubusercontent.com/antirez/redis/5.0/00-RELEASENOTES
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10192