Skip to content
OpenAdvisories
Medium · 5.5 CVE-2024-25116 EUVD-2024-22476

Specially crafted CF.RESERVE command can lead to denial-of-service

Published Apr 9, 2024 · Updated Aug 1, 2024 · Assigned by GitHub_M

Description

RedisBloom adds a set of probabilistic data structures to Redis. Starting in version 2.0.0 and prior to version 2.4.7 and 2.6.10, authenticated users can use the `CF.RESERVE` command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in RedisBloom 2.4.7 and 2.6.10.

Affected products

VendorProductAffectedFixed
RedisBloom RedisBloom >= 2.0.0, < 2.4.7, >= 2.5.0, < 2.6.10 —

References