Description
A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By corrupting a hyperloglog using the SETRANGE command, an attacker could cause Redis to perform controlled increments of up to 12 bytes past the end of a stack-allocated buffer.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Redis Labs | redis | 3.x before 3.2.13, 4.x before 4.0.14, 5.x before 5.0.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | redis | 5:5.0.4-1 | — |
| Debian 13 | redis | 5:5.0.4-1 | — |
| Debian 12 | redis | 5:5.0.4-1 | — |
| Debian 10 | redis | 5:5.0.3-4+deb10u1 | DSA-4480-1 |
| Debian 9 | redis | 3:3.2.6-3+deb9u3 | DSA-4480-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | redis +2 | 5.0.3-2.module+el8.0.0.z+3657+acb471dc | RHSA-2019:2002 |
| RHEL 3 | rh-redis5-redis | 5.0.5-1.el7 | RHSA-2019:1819 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | redis | 5.0.3-2.module+el8.4.0+393+5af13779 | RLSA-2019:2002 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | redis | 5.0.4-r0 | — |
| Alpine v3.23 | redis | 5.0.4-r0 | — |
| Alpine v3.22 | redis | 5.0.4-r0 | — |
| Alpine v3.21 | redis | 5.0.4-r0 | — |
| Alpine v3.20 | redis | 5.0.4-r0 | — |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | redis | 5.0.4-r0 | — |
| Alpine v3.18 | redis | 5.0.4-r0 | — |
| Alpine v3.17 | redis | 5.0.4-r0 | — |
| Alpine v3.16 | redis | 5.0.4-r0 | — |
| Alpine v3.15 | redis | 5.0.4-r0 | — |
| Alpine v3.14 | redis | 5.0.4-r0 | — |
| Alpine v3.13 | redis | 5.0.4-r0 | — |
| Alpine v3.12 | redis | 5.0.4-r0 | — |
| Alpine v3.11 | redis | 5.0.4-r0 | — |
| Alpine v3.10 | redis | 5.0.4-r0 | — |
| Alpine v3.9 | redis | 4.0.14-r0 | — |
| Alpine v3.8 | redis | 4.0.14-r0 | — |
| Alpine v3.7 | redis | 4.0.14-r0 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | redis +2 | 5.0.3-2.module+el8.0.0.z+5250+19ca22c8 | ELSA-2019-2002 |
Advisories 6
- WID-SEC-2022-0517 Red Hat Enterprise Linux: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 18, 2026
- RHSA-2019:2002 Red Hat Security Advisory: redis:5 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2019:1819 Red Hat Security Advisory: rh-redis5-redis security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-4480-1 redis - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2019:2002 Important: redis:5 security update Rocky Linux Security Advisories · Feb 4, 2026
- ELSA-2019-2002 Important: redis:5 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 19, 2019
References
- DSA-4480 vendor-advisory
- 20190712 [SECURITY] [DSA 4480-1] redis security update mailing-list
- USN-4061-1 vendor-advisory
- 109290 vdb-entry
- RHSA-2019:1819 vendor-advisory
- RHSA-2019:2002 vendor-advisory
- GLSA-201908-04 vendor-advisory
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://raw.githubusercontent.com/antirez/redis/3.2/00-RELEASENOTES
- https://raw.githubusercontent.com/antirez/redis/4.0/00-RELEASENOTES
- https://raw.githubusercontent.com/antirez/redis/5.0/00-RELEASENOTES
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10193