Redis vulnerabilities
51 CVEs and advisories name Redis as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-81934Redis TLS pending-data list use-after-free
- CVE-2026-66373Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payl
- CVE-2026-25243redis-server RESTORE invalid memory access may allow remote code execution
- CVE-2026-23631redis-server Lua use-after-free may allow remote code execution
- CVE-2026-23479redis-server use-after-free in unblock client flow may allow remote code execution
- CVE-2025-62507Redis: Bug in XACKDEL may lead to stack overflow and potential RCE
- CVE-2025-49844Redis Lua Use-After-Free may lead to remote code execution
- CVE-2025-46819Redis is vulnerable to DoS via specially crafted LUA scripts
- CVE-2025-46818Redis: Authenticated users can execute LUA scripts as a different user
- CVE-2025-46817Lua library commands may lead to integer overflow and potential RCE
- CVE-2025-46686Redis through 8.0.3 allows memory consumption via a multi-bulk command composed of many bulks, sent by an authenticated user.
- CVE-2025-48367Redis DoS Vulnerability due to bad connection error handling
- CVE-2025-32023Redis allows out of bounds writes in hyperloglog commands leading to RCE
- CVE-2025-27151redis-check-aof may lead to stack overflow and potential RCE
- CVE-2025-21605Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client
- CVE-2025-29923go-redis allows potential out of order responses when `CLIENT SETINFO` times out during connection establishment
- CVE-2024-51741Redis allows denial-of-service due to malformed ACL selectors
- CVE-2024-46981Redis' Lua library commands may lead to remote code execution
- CVE-2024-31449Lua library commands may lead to stack overflow and RCE in Redis
- CVE-2024-31228Denial-of-service due to unbounded pattern matching in Redis
- CVE-2024-31227Denial-of-service due to malformed ACL selectors in Redis
- CVE-2023-41056Redis vulnerable to integer overflow in certain payloads
- CVE-2023-45145Redis Unix-domain socket may have be exposed with the wrong permissions for a short time window.
- CVE-2023-41053Redis SORT_RO may bypass ACL configuration
- CVE-2022-24834Heap overflow issue with the Lua cjson library used by Redis
- CVE-2023-36824Heap overflow in COMMAND GETKEYS and ACL evaluation in Redis
- CVE-2023-28856`HINCRBYFLOAT` can be used to crash a redis-server process
- CVE-2023-28425Specially crafted MSETNX command can lead to denial-of-service
- CVE-2023-25155Integer Overflow in several Redis commands can lead to denial of service.
- CVE-2022-36021Redis string pattern matching can be abused to achieve Denial of Service