Redis
Vendor:
First CVE: Jun 9, 2015 · Active for 11 years
22
Total CVEs
More Total CVEs than 94% of tracked products
3.1
Avg CVEs / Year
Higher CVE frequency than 81% of tracked products
7.8
Avg CVSS
Higher Avg CVSS than 67% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Redis over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jun 9, 2015
11 years ago
Most Recent CVE
Sep 20, 2021
1,768 days ago
CVE Severity & Scoring
Redis22 CVEs
14%
64%
18%
All CVEs352,231 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local4 (18.2%)
Network17 (77.3%)
Unknown1 (4.5%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low20 (90.9%)
High1 (4.5%)
Unknown1 (4.5%)
User Interaction
None20 (90.9%)
Unknown1 (4.5%)
Required1 (4.5%)
Privileges Required
Low9 (40.9%)
High2 (9.1%)
None10 (45.5%)
Unknown1 (4.5%)
Top CVEs
Signals from CVEs in this product scope (22 CVEs).
22 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-11218CRITICAL Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer overfl | Jun 17, 2018 | 9.8 | 73 | NO | YES |
CVE-2018-12453HIGH Type confusion in the xgroupCommand function in t_stream.c in redis-server in Redis before 5.0 allows remote attackers to cause denial-of-service via an XGROUP command in which the | Jun 16, 2018 | 7.5 | 47 | NO | YES |
CVE-2021-32761HIGH Redis is an in-memory database that persists on disk. A vulnerability involving out-of-bounds read and integer overflow to buffer overflow exists starting with version 2.2 and prio | Jul 21, 2021 | 7.5 | 41 | NO | NO |
CVE-2019-10192HIGH A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By carefully corrupting a | Jul 11, 2019 | 7.2 | 37 | NO | NO |
CVE-2018-12326HIGH Buffer overflow in redis-cli of Redis before 4.0.10 and 5.x before 5.0 RC3 allows an attacker to achieve code execution and escalate to higher privileges via a crafted command line | Jun 17, 2018 | 8.4 | 37 | NO | YES |
CVE-2016-8339CRITICAL A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. An out of bounds write vulnerability exists in the handling of the c | Oct 28, 2016 | 9.8 | 37 | NO | NO |
CVE-2019-10193HIGH A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By corrupting a hyperlog | Jul 11, 2019 | 7.2 | 36 | NO | NO |
CVE-2018-11219CRITICAL An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2, leading to a failure of bound | Jun 17, 2018 | 9.8 | 32 | NO | NO |
CVE-2017-15047CRITICAL The clusterLoadConfig function in cluster.c in Redis 4.0.2 allows attackers to cause a denial of service (out-of-bounds array index and application crash) or possibly have unspecif | Oct 6, 2017 | 9.8 | 31 | NO | NO |
CVE-2021-29477HIGH Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer could b | May 4, 2021 | 8.8 | 29 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (22 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
1 CVE
4.5% of CVEs· 96th percentile
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
2 CVEs
9.1% of CVEs· 89th percentile
Social Chatter
Signals from CVEs in this product scope (22 CVEs).
Media Mentions
Signals from CVEs in this product scope (22 CVEs).
Top CNAs Publishing CVEs For Redis
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 6.2.0 | 1 | 5.3 | 1.1% | 0 | 0 |
| 5.0.7 | 1 | 7.5 | 1.2% | 0 | 0 |
| 5.0 | 3 | 9.1 | 18.0% | 0 | 2 |
| 4.0.2 | 1 | 9.8 | 1.8% | 0 | 0 |
| 3.2.3 | 1 | 9.8 | 14.8% | 0 | 0 |
| 3.2.2 | 1 | 9.8 | 14.8% | 0 | 0 |
| 3.2.1 | 1 | 9.8 | 14.8% | 0 | 0 |
| 3.2.0 | 1 | 9.8 | 14.8% | 0 | 0 |
| 3.0.1 | 1 | 10.0 | 9.6% | 0 | 0 |
| 3.0.0 | 1 | 10.0 | 9.6% | 0 | 0 |
| 2.6.0 | 1 | 5.5 | 0.3% | 0 | 0 |