CVE-2024-31449High· 7.0▾ MidnightPoC availableRedis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. T…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 38.5 · likelihood 0.9 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
4.5%
1 GitHub repo (last check)
Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
redis >= 2.6, < 6.2.16redis >= 7.0.0, < 7.2.6redis >= 7.3.0, < 7.4.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-34108High· 8.6Disk Pulse Enterprise 9.0.34 Login Stack Buffer Overflow
CVE-2025-46836Medium· 6.6net-tools Stack-based Buffer Overflow vulnerability
CVE-2026-23479High· 8.8Redis is an in-memory data structure store
CVE-2026-25243High· 8.8Redis is an in-memory data structure store
CVE-2026-23631High· 8.1Redis is an in-memory data structure store
CVE-2020-21468High· 7.5A segmentation fault in the redis-server component of Redis 5.0.7 leads to a denial of service (DOS)