# cve.now: Redis

The newest entries naming Redis as an affected vendor (up to 200), of 51 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-81934](https://cve.now/CVE-2026-81934.md): Redis TLS pending-data list use-after-free (CVSS 7.1)
- [CVE-2026-66373](https://cve.now/CVE-2026-66373.md): Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payl (CVSS 7.5)
- [CVE-2026-25243](https://cve.now/CVE-2026-25243.md): redis-server RESTORE invalid memory access may allow remote code execution (CVSS 7.7)
- [CVE-2026-23631](https://cve.now/CVE-2026-23631.md): redis-server Lua use-after-free may allow remote code execution (CVSS 6.1)
- [CVE-2026-23479](https://cve.now/CVE-2026-23479.md): redis-server use-after-free in unblock client flow may allow remote code execution (CVSS 7.7)
- [CVE-2025-62507](https://cve.now/CVE-2025-62507.md): Redis: Bug in XACKDEL may lead to stack overflow and potential RCE (CVSS 7.7)
- [CVE-2025-49844](https://cve.now/CVE-2025-49844.md): Redis Lua Use-After-Free may lead to remote code execution (CVSS 10.0)
- [CVE-2025-46819](https://cve.now/CVE-2025-46819.md): Redis is vulnerable to DoS via specially crafted LUA scripts (CVSS 6.3)
- [CVE-2025-46818](https://cve.now/CVE-2025-46818.md): Redis: Authenticated users can execute LUA scripts as a different user (CVSS 6.0)
- [CVE-2025-46817](https://cve.now/CVE-2025-46817.md): Lua library commands may lead to integer overflow and potential RCE (CVSS 7.0)
- [CVE-2025-46686](https://cve.now/CVE-2025-46686.md): Redis through 8.0.3 allows memory consumption via a multi-bulk command composed of many bulks, sent by an authenticated user. (CVSS 3.5)
- [CVE-2025-48367](https://cve.now/CVE-2025-48367.md): Redis DoS Vulnerability due to bad connection error handling (CVSS 7.5)
- [CVE-2025-32023](https://cve.now/CVE-2025-32023.md): Redis allows out of bounds writes in hyperloglog commands leading to RCE (CVSS 7.0)
- [CVE-2025-27151](https://cve.now/CVE-2025-27151.md): redis-check-aof may lead to stack overflow and potential RCE (CVSS 4.7)
- [CVE-2025-21605](https://cve.now/CVE-2025-21605.md): Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client (CVSS 7.5)
- [CVE-2025-29923](https://cve.now/CVE-2025-29923.md): go-redis allows potential out of order responses when \`CLIENT SETINFO\` times out during connection establishment (CVSS 3.7)
- [CVE-2024-51741](https://cve.now/CVE-2024-51741.md): Redis allows denial-of-service due to malformed ACL selectors (CVSS 4.4)
- [CVE-2024-46981](https://cve.now/CVE-2024-46981.md): Redis' Lua library commands may lead to remote code execution (CVSS 7.0)
- [CVE-2024-31449](https://cve.now/CVE-2024-31449.md): Lua library commands may lead to stack overflow and RCE in Redis (CVSS 7.0)
- [CVE-2024-31228](https://cve.now/CVE-2024-31228.md): Denial-of-service due to unbounded pattern matching in Redis (CVSS 5.5)
- [CVE-2024-31227](https://cve.now/CVE-2024-31227.md): Denial-of-service due to malformed ACL selectors in Redis (CVSS 4.4)
- [CVE-2023-41056](https://cve.now/CVE-2023-41056.md): Redis vulnerable to integer overflow in certain payloads (CVSS 8.1)
- [CVE-2023-45145](https://cve.now/CVE-2023-45145.md): Redis Unix-domain socket may have be exposed with the wrong permissions for a short time window. (CVSS 3.6)
- [CVE-2023-41053](https://cve.now/CVE-2023-41053.md): Redis SORT\_RO may bypass ACL configuration (CVSS 3.3)
- [CVE-2022-24834](https://cve.now/CVE-2022-24834.md): Heap overflow issue with the Lua cjson library used by Redis (CVSS 7.0)
- [CVE-2023-36824](https://cve.now/CVE-2023-36824.md): Heap overflow in COMMAND GETKEYS and ACL evaluation in Redis (CVSS 7.4)
- [CVE-2023-28856](https://cve.now/CVE-2023-28856.md): \`HINCRBYFLOAT\` can be used to crash a redis-server process (CVSS 5.5)
- [CVE-2023-28425](https://cve.now/CVE-2023-28425.md): Specially crafted MSETNX command can lead to denial-of-service (CVSS 5.5)
- [CVE-2023-25155](https://cve.now/CVE-2023-25155.md): Integer Overflow in several Redis commands can lead to denial of service. (CVSS 5.5)
- [CVE-2022-36021](https://cve.now/CVE-2022-36021.md): Redis string pattern matching can be abused to achieve Denial of Service (CVSS 5.5)
- [CVE-2022-35977](https://cve.now/CVE-2022-35977.md): Integer overflow in certain command arguments can drive Redis to OOM panic (CVSS 5.5)
- [CVE-2023-22458](https://cve.now/CVE-2023-22458.md): Integer overflow in multiple Redis commands can lead to denial-of-service (CVSS 5.5)
- [CVE-2022-35951](https://cve.now/CVE-2022-35951.md): Redis subject to Integer Overflow leading to Remote Code Execution via Heap Overflow (CVSS 7.0)
- [CVE-2022-31144](https://cve.now/CVE-2022-31144.md): Potential heap overflow in Redis (CVSS 7.0)
- [CVE-2022-24736](https://cve.now/CVE-2022-24736.md): A Malformed Lua script can crash Redis (CVSS 3.3)
- [CVE-2022-24735](https://cve.now/CVE-2022-24735.md): Lua scripts can be manipulated to overcome ACL rules in Redis (CVSS 3.9)
- [CVE-2021-41099](https://cve.now/CVE-2021-41099.md): Integer overflow issue with strings in Redis (CVSS 7.5)
- [CVE-2021-32762](https://cve.now/CVE-2021-32762.md): Integer overflow that can lead to heap overflow in redis-cli, redis-sentinel on some platforms (CVSS 7.5)
- [CVE-2021-32687](https://cve.now/CVE-2021-32687.md): Integer overflow issue with intsets in Redis (CVSS 7.5)
- [CVE-2021-32675](https://cve.now/CVE-2021-32675.md): DoS vulnerability in Redis (CVSS 7.5)
- [CVE-2021-32672](https://cve.now/CVE-2021-32672.md): Vulnerability in Lua Debugger in Redis (CVSS 5.3)
- [CVE-2021-32627](https://cve.now/CVE-2021-32627.md): Integer overflow issue with Streams in Redis (CVSS 7.5)
- [CVE-2021-32628](https://cve.now/CVE-2021-32628.md): Vulnerability in handling large ziplists (CVSS 7.5)
- [CVE-2021-32626](https://cve.now/CVE-2021-32626.md): Lua scripts can overflow the heap-based Lua stack in Redis (CVSS 7.5)
- [CVE-2021-32765](https://cve.now/CVE-2021-32765.md): Integer Overflow to Buffer Overflow in Hiredis (CVSS 8.8)
- [CVE-2021-32761](https://cve.now/CVE-2021-32761.md): Integer overflow issues with \*BIT commands on 32-bit systems (CVSS 7.5)
- [CVE-2021-32625](https://cve.now/CVE-2021-32625.md): Redis vulnerability in STRALGO LCS on 32-bit systems (CVSS 7.5)
- [CVE-2021-29478](https://cve.now/CVE-2021-29478.md): Vulnerability in the COPY command for large intsets (CVSS 7.5)
- [CVE-2021-29477](https://cve.now/CVE-2021-29477.md): Vulnerability in the STRALGO LCS command (CVSS 7.5)
- [CVE-2021-21309](https://cve.now/CVE-2021-21309.md): Integer overflow on 32-bit systems (CVSS 5.4)
- [CVE-2016-8339](https://cve.now/CVE-2016-8339.md): A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. (CVSS 6.6)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/redis
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.