CVE-2020-14147

The CVE-2020-14147 issue is a vulnerability in Redis: an integer overflow in the getnum function of lua_struct.c on Redis builds before 6.0.3 can be triggered by processing large numbers in Lua code, leading to memory corruption, a denial of service (application crash), and potentially bypassing ...

CVE-2018-12326

CVE-2018-12326 is a vulnerability in Redis: buffer overflow in redis-cli that can allow code execution and privilege escalation via a crafted command line. Affected: Redis before 4.0.10 and 5.x before 5.0 RC3. Impact per documents: potential code execution and privilege escalation with high sever...

CVE-2018-11219

CVE-2018-11219 is a Redis Lua subsystem integer overflow vulnerability (bounds checking failure) affecting Redis up to versions prior to 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2. The issue originates in lua_struct.c:b_unpack() and can lead to memory corruption or a crash. Public details ...

CVE-2018-11218

CVE-2018-11218 describes a memory corruption vulnerability in the Redis Lua subsystem’s cmsgpack handling, caused by stack-based buffer overflows. Affected Redis versions are before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2. Several connected sources reiter the issue as a Redis component ...

CVE-2021-3470

CVE-2021-3470 is a Redis heap overflow vulnerability affecting versions before 5.0.10, before 6.0.9, and before 6.2.0 when using a heap allocator other than jemalloc or glibc malloc, potentially causing an out-of-bounds write or process crash. The flaw primarily affects setups not using jemalloc/...

CVE-2013-0178

CVE-2013-0178 affects Redis before 2.6, with an insecure temporary file vulnerability related to /tmp/redis-%p.vm. The connected documents confirm the affected software and the insecure temp-file root cause but do not provide exploitation details, impact specifics, or any remediation/patch inform...

CVE-2016-10517

CVE-2016-10517 describes a Cross Protocol Scripting vulnerability in Redis prior to 3.2.7. The issue arises in networking.c where Redis does not validate HTTP-like elements (POST and Host:) in data that can arrive on the Redis TCP port, allowing an HTTP-style request to be misinterpreted as a Red...

CVE-2018-12453

CVE-2018-12453 affects Redis before 5.0, where a type confusion in xgroupCommand (t_stream.c) lets remote attackers trigger DoS when an XGROUP command is issued on a non-stream key. Exploitation PoCs exist (e.g., via redis-cli xgroup create and network-based triggers). IBM/OSS sources corroborate...