CVEvulnerability
CVE-2023-22458
5.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2023-01-20
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- CVSS 3.1 ([email protected])
- 5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-190
Description
Redis is an in-memory database that persists on disk. Authenticated users can issue a `HRANDFIELD` or `ZRANDMEMBER` command with specially crafted arguments to trigger a denial-of-service by crashing Redis with an assertion failure. This problem affects Redis versions 6.2 or newer up to but not including 6.2.9 as well as versions 7.0 up to but not including 7.0.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected configurations
• redis redis (>= 6.2.0 < 6.2.9)
• redis redis (>= 7.0.0 < 7.0.8)
Related
Weakness · CWE (1)
- CWE-190 Integer Overflow or Wraparound weakness
References
- https://github.com/redis/redis/commit/16f408b1a0121cacd44cbf8aee275d69dc627f02 Patch, Third Party Advisory
- https://github.com/redis/redis/releases/tag/6.2.9 Release Notes, Third Party Advisory
- https://github.com/redis/redis/releases/tag/7.0.8 Release Notes, Third Party Advisory
- https://github.com/redis/redis/security/advisories/GHSA-r8w2-2m53-gprj Third Party Advisory
- https://github.com/redis/redis/commit/16f408b1a0121cacd44cbf8aee275d69dc627f02 Patch, Third Party Advisory
- https://github.com/redis/redis/releases/tag/6.2.9 Release Notes, Third Party Advisory
- https://github.com/redis/redis/releases/tag/7.0.8 Release Notes, Third Party Advisory
- https://github.com/redis/redis/security/advisories/GHSA-r8w2-2m53-gprj Third Party Advisory