CVE-2024-31228

MEDIUM

Redis 2.2.5-6.2.15 - Authenticated Denial of Service via Long String Match Pattern Recursion

Title source: llm
STIX 2.1

Description

Redis is an open source, in-memory database that persists on disk. Authenticated users can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as `KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION LIST`, `COMMAND LIST` and ACL definitions. Matching of extremely long patterns may result in unbounded recursion, leading to stack overflow and process crash. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

References (3)

Core 3

Scores

CVSS v3 5.5
EPSS 0.0101
EPSS Percentile 58.4%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-674
Status published
Products (2)
redis/redis 7.4.0 (3 CPE variants)
redis/redis 2.2.5 - 6.2.16
Published Oct 07, 2024
Tracked Since Feb 18, 2026