Axel Mierczuk

When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin. This behavior results in the intended credentials for the request remaining unused.

The issue is related to an open-source, in-memory database that persists on disk. An authenticated user with sufficient privileges can create a malformed ACL selector, which, when accessed, triggers a server panic and subsequent denial of service.

The issue exists due to insufficient input validation in Redis, allowing a remote attacker to cause a denial of service. An authenticated user with sufficient privileges may create a malformed ACL selector, which when accessed, triggers a server panic and subsequent denial of service.