Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2022-24736

22
FAUCET Score

CVE-2022-24736 is a NULL pointer dereference vulnerability in Redis, affecting versions prior to 6.2.7 and 7.0.0, as well as products like Fedora, NetApp, and Oracle that integrate Redis. An authenticated attacker can crash the redis-server process by loading a specially crafted Lua script. Rated Medium (CVSS 5.5), this vulnerability requires local access and has a high impact on availability, but no impact on confidentiality or integrity. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.

Impacted Technologies

VendorProductVersion(s)CPE
< 6.2.7CPE matchmatch criteria
cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*
7.0CPE matchmatch criteria
cpe:2.3:a:redis:redis:7.0:rc1:*:*:*:*:*:*
7.0CPE matchmatch criteria
cpe:2.3:a:redis:redis:7.0:rc2:*:*:*:*:*:*
7.0CPE matchmatch criteria
cpe:2.3:a:redis:redis:7.0:rc3:*:*:*:*:*:*
34CPE matchmatch criteria
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

3.3LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
Exploitability Score
1.8
Impact Score
1.4
CvssVersion
3.1

Exploit Intelligence

EPSS Score
1.50%
Probability of exploitation in next 30 days
EPSS Percentile
71.6%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
This CVE's current EPSS score of 0.0150 is in the 98th percentile among its peer group of 15,940 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (21)

github_advisorypatch availablevia nvd_reference
View patch
microsoftpatch availablevia msrc
Product: 18721-16820Fixed in: 6.2.7-1
microsoftpatch availablevia msrc
Product: 18722-16823Fixed in: 6.2.7-1
microsoftpatch availablevia msrc
Product: cbl2 redis 6.2.7-1 on CBL Mariner 2.0Fixed in: 6.2.7-1
microsoftpatch availablevia msrc
Product: CBL Mariner 1.0 x64Fixed in: 6.2.7-1
microsoftpatch availablevia msrc
Product: CBL Mariner 1.0 ARMFixed in: 6.2.7-1
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 x64Fixed in: 6.2.7-1
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 ARMFixed in: 6.2.7-1
microsoftpatch availablevia msrc
Product: cm1 redis 6.2.7-1 on CBL Mariner 1.0Fixed in: 6.2.7-1
oraclepatch availablevia nvd_reference
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: redis-0:6.2.7-1.el9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: redis:6-8070020220509142426.3b9f49c4
View patch
redhatvendor investigatingvia redhat_api
Product: Red Hat Software CollectionsFixed in: rh-redis5-redis
redhatvendor investigatingvia redhat_api
Product: Red Hat Software CollectionsFixed in: rh-redis6-redis
redhatvendor investigatingvia redhat_api
Product: Red Hat Advanced Cluster Management for Kubernetes 2Fixed in: rhacm2/search-api-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: redis:5/redis
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: io.hawt-hawtio-integration
redhatvendor investigatingvia redhat_api
Product: Red Hat Advanced Cluster Management for Kubernetes 2Fixed in: rhacm2/redisgraph-tls-rhel8
redhatno patchvia redhat_api
Product: Red Hat 3scale API Management Platform 2Fixed in: redis
redhatno patchvia redhat_api
Product: Red Hat Ansible Automation Platform 1.2Fixed in: redis
redhatno patchvia redhat_api
Product: Red Hat Ansible Tower 3Fixed in: redis

Vendor Advisories (3)

microsoft2022-May/CVE-2022-24736

CVE-2022-24736

May 10, 2022
redhatCVE-2022-24736Low

redis: Malformed Lua script can crash Redis

Apr 27, 2022
microsoft2022-Apr/CVE-2022-24736Moderate

A Malformed Lua script can crash Redis

Apr 12, 2022

References

github.com / redis/redis/pull/10651
ExploitThird Party Advisory
github.com / redis/redis/releases/tag/6.2.7
Release NotesThird Party Advisory
github.com / redis/redis/releases/tag/7.0.0
Release NotesThird Party Advisory
github.com / redis/redis/security/advisories/GHSA-3qpw-7686-5984
PatchThird Party Advisory
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/J4ZK3675DGHVVDOFLJN7WX6YYH27GPMK
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/VPYKSG7LKUJGVM2P72EHXKVRVRWHLORX
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/WSTPUCAPBRHIFPSCOURR4OYX4E2OISAF
security.gentoo.org / glsa/202209-17
Third Party Advisory
security.netapp.com / advisory/ntap-20220715-0003
Third Party Advisory
oracle.com / security-alerts/cpujul2022.html
PatchThird Party Advisory