Cloudanix VulnDB

CVE-2024-31228

None

CVSS

—

EPSS

1.0%

Published

Oct 7, 2024

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in Redis lets logged-in users send specially crafted commands that crash the database server, making applications that rely on it stop working until it is restarted.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
Application
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Authenticated users can supply extremely long match patterns to commands including KEYS, SCAN, PSUBSCRIBE, FUNCTION LIST, COMMAND LIST, and ACL definitions, triggering unbounded recursion that overflows the stack and crashes the Redis process.

Why it matters to the business

Redis instances become unavailable until restarted, causing application downtime, interrupted caching, session loss, and potential data-processing delays in environments that depend on the service.

How an attack unfolds

An attacker with valid Redis credentials crafts a command containing an excessively long pattern string and sends it to a vulnerable server; the server enters deep recursion during pattern matching, exhausts the call stack, and terminates, denying service to all users.

How to fix it

Upgrade redis to 6.2.16, 7.2.6, or 7.4.1 (or the equivalent commit ad950e4c32d9ebff932f157cfad135bde4fadce4). For the Go package ecies/go/v2 upgrade to 2.0.8. No workarounds exist; apply the patches promptly.

How to confirm the fix worked

Confirm the running Redis binary reports one of the fixed versions; attempt a controlled long-pattern command in a test environment and verify the process remains stable; monitor for absence of crash reports after upgrade.

Typical attack path

  1. Obtain valid Redis authentication credentials
  2. Connect to the target Redis instance
  3. Issue a supported command (KEYS, SCAN, PSUBSCRIBE, etc.) containing a crafted, extremely long pattern
  4. Observe server crash and loss of availability

How to detect it

Review Redis server logs and operating-system crash dumps for sudden terminations during pattern-matching commands; correlate with authentication events and unusually long argument strings in command audit logs.

  • redis-server segmentation fault
  • stack overflow during pattern match
  • long argument to KEYS/SCAN/PSUBSCRIBE/FUNCTION LIST/COMMAND LIST

What your security team should do

  • Immediately schedule upgrades to the fixed Redis versions
  • Restrict Redis access to trusted networks and enforce strong authentication
  • Monitor process health and restart automation for Redis instances until patches are applied
  • Review and limit use of pattern-matching commands from untrusted clients

The record

Redis is an open source, in-memory database that persists on disk. Authenticated users can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as `KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION LIST`, `COMMAND LIST` and ACL definitions. Matching of extremely long patterns may result in unbounded recursion, leading to stack overflow and process crash. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected packages

Ecosystem Package Introduced Fixed
AlmaLinux:8 redis 0 6.2.17-1.module_el8.10.0+3946+3de613d5
AlmaLinux:8 redis-devel 0 6.2.17-1.module_el8.10.0+3946+3de613d5
AlmaLinux:8 redis-doc 0 6.2.17-1.module_el8.10.0+3946+3de613d5
AlmaLinux:9 redis 0 6.2.17-1.el9_5
AlmaLinux:9 redis 0 7.2.6-1.module_el9.5.0+130+36ae7635
AlmaLinux:9 redis-devel 0 6.2.17-1.el9_5
AlmaLinux:9 redis-devel 0 7.2.6-1.module_el9.5.0+130+36ae7635
AlmaLinux:9 redis-doc 0 6.2.17-1.el9_5
AlmaLinux:9 redis-doc 0 7.2.6-1.module_el9.5.0+130+36ae7635
Alpine:v3.15 redis 0 6.2.18-r0
Alpine:v3.17 redis 0 7.0.15-r1
Alpine:v3.18 redis 0 7.0.15-r1
Alpine:v3.19 redis 0 7.2.4-r1
Alpine:v3.20 valkey 0 7.2.7-r0
Alpine:v3.21 valkey 0 7.2.7-r0
Alpine:v3.22 valkey 0 7.2.7-r0
Bitnami keydb 2.2.5 6.2.16
Bitnami keydb 2.2.5 6.3.4
Bitnami redis 2.2.5 6.2.16
Bitnami valkey 0 7.2.7
Bitnami valkey 2.2.5 6.2.16
Chainguard py3-redis 0 0
Chainguard py3.10-redis 0 0
Chainguard py3.11-redis 0 0
Chainguard py3.12-redis 0 0
Chainguard py3.13-redis 0 0
Chainguard redis-6.2 0 6.2.16-r0
Chainguard redis-6.2-bitnami-compat 0 6.2.16-r0
Chainguard redis-6.2-iamguarded-compat 0 6.2.16-r0
Chainguard redis-6.2.10-benchmark 0 6.2.10-r40
Chainguard redis-6.2.10-cli 0 6.2.10-r40
Chainguard redis-7.2 0 7.2.6-r0
Chainguard redis-7.2-bitnami-compat 0 7.4.1-r0
Chainguard redis-7.2-iamguarded-compat 0 7.2.12-r2
Chainguard redis-7.4 0 7.4.1-r0
Chainguard redis-7.4-bitnami-compat 0 7.4.1-r0
Chainguard redis-7.4-iamguarded-compat 0 7.4.1-r0
Chainguard redis-benchmark-6.2 0 6.2.16-r0
Chainguard redis-benchmark-7.2 0 7.2.12-r2
Chainguard redis-benchmark-7.4 0 7.4.1-r0
Chainguard redis-check-aof-6.2 0 6.2.16-r0
Chainguard redis-check-rdb-6.2 0 6.2.16-r0
Chainguard redis-cli-6.2 0 6.2.16-r0
Chainguard redis-cli-7.2 0 7.4.1-r0
Chainguard redis-cli-7.4 0 7.4.1-r0
Chainguard redis-cluster-6.2-bitnami-compat 0 6.2.16-r0
Chainguard redis-cluster-6.2-iamguarded-compat 0 6.2.16-r0
Chainguard redis-cluster-7.2-bitnami-compat 0 7.4.1-r0
Chainguard redis-cluster-7.2-iamguarded-compat 0 7.2.12-r2
Chainguard redis-cluster-7.4-bitnami-compat 0 7.4.1-r0
Chainguard redis-cluster-7.4-iamguarded-compat 0 7.4.1-r0
Chainguard redis-sentinel-6.2 0 6.2.16-r0
Chainguard redis-sentinel-6.2-bitnami-compat 0 6.2.16-r0
Chainguard redis-sentinel-6.2-iamguarded-compat 0 6.2.16-r0
Chainguard redis-sentinel-7.2-bitnami-compat 0 7.4.1-r0
Chainguard redis-sentinel-7.2-iamguarded-compat 0 7.2.12-r2
Chainguard redis-sentinel-7.4-bitnami-compat 0 7.4.1-r0
Chainguard redis-sentinel-7.4-iamguarded-compat 0 7.4.1-r0
Debian:11 redis 0 No fix
Debian:11 redis 0 5:6.0.16-1+deb11u4
Debian:12 redis 0 No fix
Debian:13 redict 0 No fix
Debian:13 redis 0 No fix
Debian:13 redis 0 5:7.0.15-2
Debian:13 valkey 0 No fix
Debian:13 valkey 0 8.0.1+dfsg1-1
Debian:14 redict 0 7.3.1+ds-1
Debian:14 redis 0 5:7.0.15-2
Debian:14 valkey 0 8.0.1+dfsg1-1
Mageia:9 redis 0 7.0.14-1.1.mga9
Red Hat:enterprise_linux:9::appstream redis 0 0:7.2.6-1.module+el9.5.0+22422+63e067d8
Red Hat:enterprise_linux:9::appstream redis-debuginfo 0 0:7.2.6-1.module+el9.5.0+22422+63e067d8
Red Hat:enterprise_linux:9::appstream redis-debugsource 0 0:7.2.6-1.module+el9.5.0+22422+63e067d8
Red Hat:enterprise_linux:9::appstream redis-devel 0 0:7.2.6-1.module+el9.5.0+22422+63e067d8
Red Hat:enterprise_linux:9::appstream redis-doc 0 0:7.2.6-1.module+el9.5.0+22422+63e067d8
Rocky Linux:8 redis 0 0:6.2.17-1.module+el8.10.0+1923+5b85c6a7
Rocky Linux:9 redis 0 0:6.2.17-1.el9_5
SUSE:Enterprise Storage 7.1 redis 0 6.0.14-150200.6.32.1
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS redis 0 6.0.14-150200.6.32.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS redis 0 6.2.6-150400.3.28.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS redis 0 6.2.6-150400.3.28.1
SUSE:Linux Enterprise Module for Server Applications 15 SP5 redis 0 6.2.6-150400.3.28.1
SUSE:Linux Enterprise Module for Server Applications 15 SP5 redis7 0 7.0.8-150500.3.12.1
SUSE:Linux Enterprise Module for Server Applications 15 SP6 redis 0 7.2.4-150600.3.3.1
SUSE:Linux Enterprise Module for Server Applications 15 SP6 redis7 0 7.0.8-150600.8.3.1
SUSE:Linux Enterprise Server 15 SP3-LTSS redis 0 6.0.14-150200.6.32.1
SUSE:Linux Enterprise Server 15 SP4-LTSS redis 0 6.2.6-150400.3.28.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP3 redis 0 6.0.14-150200.6.32.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4 redis 0 6.2.6-150400.3.28.1
SUSE:Manager Proxy 4.3 redis 0 6.2.6-150400.3.28.1
SUSE:Manager Server 4.3 redis 0 6.2.6-150400.3.28.1
Ubuntu:20.04:LTS redis 0 No fix
Ubuntu:22.04:LTS redis 0 No fix
Ubuntu:24.04:LTS redis 0 No fix
Ubuntu:24.04:LTS redis 0 5:7.0.15-1ubuntu0.24.04.1
Ubuntu:24.10 redis 0 No fix
Ubuntu:25.04 redis 0 No fix
Ubuntu:25.10 redis 0 No fix
Ubuntu:Pro:14.04:LTS redis 0 No fix
Ubuntu:Pro:16.04:LTS redis 0 No fix
Ubuntu:Pro:16.04:LTS redis 0 2:3.0.6-1ubuntu0.4+esm3
Ubuntu:Pro:18.04:LTS redis 0 No fix
Ubuntu:Pro:18.04:LTS redis 0 5:4.0.9-1ubuntu0.2+esm5
Ubuntu:Pro:20.04:LTS redis 0 5:5.0.7-2ubuntu0.1+esm3
Ubuntu:Pro:22.04:LTS redis 0 5:6.0.16-1ubuntu1+esm2
Wolfi redis-6.2 0 6.2.16-r0
Wolfi redis-6.2-bitnami-compat 0 6.2.16-r0
Wolfi redis-7.2 0 7.2.6-r0
Wolfi redis-7.2-bitnami-compat 0 7.4.1-r0
Wolfi redis-7.4 0 7.4.1-r0
Wolfi redis-benchmark-6.2 0 6.2.16-r0
Wolfi redis-benchmark-7.2 0 7.2.12-r2
Wolfi redis-check-aof-6.2 0 6.2.16-r0
Wolfi redis-check-rdb-6.2 0 6.2.16-r0
Wolfi redis-cli-6.2 0 6.2.16-r0
Wolfi redis-cli-7.2 0 7.4.1-r0
Wolfi redis-cluster-6.2-bitnami-compat 0 6.2.16-r0
Wolfi redis-cluster-7.2-bitnami-compat 0 7.4.1-r0
Wolfi redis-sentinel-6.2 0 6.2.16-r0
Wolfi redis-sentinel-6.2-bitnami-compat 0 6.2.16-r0
Wolfi redis-sentinel-7.2-bitnami-compat 0 7.4.1-r0
openSUSE:Leap 15.5 redis 0 6.2.6-150400.3.28.1
openSUSE:Leap 15.5 redis7 0 7.0.8-150500.3.12.1
openSUSE:Leap 15.6 redis 0 7.2.4-150600.3.3.1
openSUSE:Leap 15.6 redis7 0 7.0.8-150600.8.3.1
openSUSE:Tumbleweed redis 0 8.0.2-1.1
openSUSE:Tumbleweed valkey 0 8.0.1-1.1

Related vulnerabilities