p PatchFirst

CVE-2024-31228

CVE-2024-31228 · Denial-of-service due to unbounded pattern matching in Redis

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Redis is an open source, in-memory database that persists on disk. Authenticated users can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as `KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION LIST`, `COMMAND LIST` and ACL definitions. Matching of extremely long patterns may result in unbounded recursion, leading to stack overflow and process crash. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS 5.5 · Medium · EPSS 1.0% · Fix available

Published
Updated

Stack: system · database

Affected products and versions

  • redis

    Versions
    • >= 2.2.5, < 6.2.16: Affected
    • >= 7.0.0, < 7.2.6: Affected
    • >= 7.3.0, < 7.4.1: Affected

    No fix published

  • redict Debian:14

    Versions
    • 7.3.0+ds-1
    • 7.3.0+ds-2
    • 7.3.0+ds-3
    • 7.3.0+ds-3~bpo12+1
    Affected ranges
    • ECOSYSTEM: < 7.3.1+ds-1

    Update to 7.3.1+ds-1

  • redis Debian:12

    Versions
    • 5:7.0.11-1
    • 5:7.0.11-1+deb12u1
    • 5:7.0.12-1
    • 5:7.0.12-2
    • 5:7.0.13-1
    • 5:7.0.13-2
    • 5:7.0.14-1
    • 5:7.0.14-2
    • 5:7.0.15-1~deb12u1
    Affected ranges
    • ECOSYSTEM: < 5:7.0.15-1~deb12u2

    Update to 5:7.0.15-1~deb12u2

  • redis Debian:13

    Affected ranges
    • ECOSYSTEM: < 5:7.0.15-2

    Update to 5:7.0.15-2

  • redis Debian:14

    Affected ranges
    • ECOSYSTEM: < 5:7.0.15-2

    Update to 5:7.0.15-2

  • valkey Debian:13

    Affected ranges
    • ECOSYSTEM: < 8.0.1+dfsg1-1

    Update to 8.0.1+dfsg1-1

  • valkey Debian:14

    Affected ranges
    • ECOSYSTEM: < 8.0.1+dfsg1-1

    Update to 8.0.1+dfsg1-1

  • redis Ubuntu:Pro:16.04:LTS

    Versions
    • 2:3.0.3-3
    • 2:3.0.5-1
    • 2:3.0.5-2
    • 2:3.0.5-3
    • 2:3.0.5-4
    • 2:3.0.6-1
    • 2:3.0.6-1ubuntu0.2
    • 2:3.0.6-1ubuntu0.3
    • 2:3.0.6-1ubuntu0.4
    • 2:3.0.6-1ubuntu0.4+esm1
    • 2:3.0.6-1ubuntu0.4+esm2
    Affected ranges
    • ECOSYSTEM: < 2:3.0.6-1ubuntu0.4+esm3

    Update to 2:3.0.6-1ubuntu0.4+esm3

  • redis Ubuntu:Pro:18.04:LTS

    Versions
    • 4:4.0.1-7
    • 4:4.0.2-6
    • 4:4.0.2-9
    • 5:4.0.5-1
    • 5:4.0.6-1
    • 5:4.0.6-2
    • 5:4.0.7-1
    • 5:4.0.8-1
    • 5:4.0.8-2
    • 5:4.0.9-1
    • 5:4.0.9-1ubuntu0.1
    • 5:4.0.9-1ubuntu0.2
    • 5:4.0.9-1ubuntu0.2+esm2
    • 5:4.0.9-1ubuntu0.2+esm3
    • 5:4.0.9-1ubuntu0.2+esm4
    Affected ranges
    • ECOSYSTEM: < 5:4.0.9-1ubuntu0.2+esm5

    Update to 5:4.0.9-1ubuntu0.2+esm5

  • redis Ubuntu:Pro:20.04:LTS

    Versions
    • 5:5.0.5-2build1
    • 5:5.0.6-1
    • 5:5.0.7-1
    • 5:5.0.7-2
    • 5:5.0.7-2ubuntu0.1~esm1
    • 5:5.0.7-2ubuntu0.1
    • 5:5.0.7-2ubuntu0.1+esm1
    • 5:5.0.7-2ubuntu0.1+esm2
    Affected ranges
    • ECOSYSTEM: < 5:5.0.7-2ubuntu0.1+esm3

    Update to 5:5.0.7-2ubuntu0.1+esm3

  • redis Ubuntu:Pro:22.04:LTS

    Versions
    • 5:6.0.15-1
    • 5:6.0.16-1
    • 5:6.0.16-1build1
    • 5:6.0.16-1ubuntu1
    • 5:6.0.16-1ubuntu1+esm1
    Affected ranges
    • ECOSYSTEM: < 5:6.0.16-1ubuntu1+esm2

    Update to 5:6.0.16-1ubuntu1+esm2

  • redis Ubuntu:24.04:LTS

    Versions
    • 5:7.0.12-1
    • 5:7.0.14-1
    • 5:7.0.14-2
    • 5:7.0.15-1
    • 5:7.0.15-1build1
    • 5:7.0.15-1build2
    Affected ranges
    • ECOSYSTEM: < 5:7.0.15-1ubuntu0.24.04.1

    Update to 5:7.0.15-1ubuntu0.24.04.1

Original sources

Check your server →