CVE-2024-31228

Name of the Vulnerable Software and Affected Versions Redis versions prior to 6.2.16 Redis versions prior to 7.2.6 Redis versions prior to 7.4.1

Description Redis, an open source, in-memory database, has a denial-of-service issue. Authenticated users can trigger this by using specially crafted, long string match patterns on supported commands such as KEYS, SCAN, PSUBSCRIBE, FUNCTION LIST, COMMAND LIST, and ACL definitions. The matching of extremely long patterns may result in unbounded recursion, leading to stack overflow and process crash.

Recommendations For versions prior to 6.2.16, upgrade to version 6.2.16 or later. For versions prior to 7.2.6, upgrade to version 7.2.6 or later. For versions prior to 7.4.1, upgrade to version 7.4.1 or later.