Check your version
redis-server --versionAffected version lines
Known vulnerabilities
| CVE | Title | Affected versions | CVSS | Exploited | EPSS | Published |
|---|---|---|---|---|---|---|
| CVE-2022-0543 | It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debia... | * | 10.0 | KEV | 99.4% | 2022-02-19 |
| CVE-2026-25243 | redis-server RESTORE invalid memory access may allow remote code execution | < 8.6.3 | 7.7 | — | 2026-05-06 | |
| CVE-2026-23631 | redis-server Lua use-after-free may allow remote code execution | < 8.6.3 | 6.1 | — | 2026-05-06 | |
| CVE-2026-23479 | redis-server use-after-free in unblock client flow may allow remote code execution | ≥ 7.2.0 < 8.6.3 | 7.7 | — | 2026-05-06 | |
| CVE-2025-62507 | Redis: Bug in XACKDEL may lead to stack overflow and potential RCE | ≥ 8.2.0 < 8.2.3 | 7.7 | — | 2025-11-05 | |
| CVE-2025-49844 | Redis Lua Use-After-Free may lead to remote code execution | < 6.2.20 ≥ 7.0 < 7.2.11 ≥ 7.4.0 < 7.4.6 | 10.0 | — | 2025-10-04 | |
| CVE-2025-46819 | Redis is vulnerable to DoS via specially crafted LUA scripts | < 6.2.20 ≥ 7.0 < 7.2.11 ≥ 7.4.0 < 7.4.6 | 6.3 | — | 2025-10-04 | |
| CVE-2025-46818 | Redis: Authenticated users can execute LUA scripts as a different user | < 6.2.20 ≥ 7.0 < 7.2.11 ≥ 7.4.0 < 7.4.6 | 6.0 | — | 2025-10-04 | |
| CVE-2025-46817 | Lua library commands may lead to integer overflow and potential RCE | < 6.2.20 ≥ 7.0 < 7.2.11 ≥ 7.4.0 < 7.4.6 | 7.0 | — | 2025-10-04 | |
| CVE-2025-48367 | Redis DoS Vulnerability due to bad connection error handling | < 6.2.19 ≥ 7.0 < 7.2.10 ≥ 7.4.0 < 7.4.5 | 7.5 | — | 2025-07-08 | |
| CVE-2025-32023 | Redis allows out of bounds writes in hyperloglog commands leading to RCE | ≥ 2.8.0 < 6.2.19 ≥ 7.2.0 < 7.2.10 ≥ 7.4.0 < 7.4.5 | 7.0 | — | 2025-07-08 | |
| CVE-2025-27151 | redis-check-aof may lead to stack overflow and potential RCE | ≥ 7.0.0 < 7.2.9 ≥ 7.4.0 < 7.4.4 ≥ 8.0.0 < 8.0.2 | 4.7 | — | 2025-05-29 | |
| CVE-2025-21605 | Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client | ≥ 2.6.0 < 6.2.18 ≥ 7.0 < 7.2.8 ≥ 7.4.0 < 7.4.3 | 7.5 | — | 2025-04-24 | |
| CVE-2024-51741 | Redis allows denial-of-service due to malformed ACL selectors | ≥ 7.0.0 < 7.2.7 ≥ 7.4.0 < 7.4.2 | 4.4 | — | 2025-01-07 | |
| CVE-2024-46981 | Redis' Lua library commands may lead to remote code execution | ≥ 6.2.0 < 6.2.17 ≥ 7.2.0 < 7.2.7 ≥ 7.4.0 < 7.4.2 | 7.0 | — | 2025-01-07 | |
| CVE-2024-31449 | Lua library commands may lead to stack overflow and RCE in Redis | ≥ 2.8.18 < 6.2.16 ≥ 7.2.0 < 7.2.6 = 7.4.0 | 7.0 | — | 2024-10-08 | |
| CVE-2024-31228 | Denial-of-service due to unbounded pattern matching in Redis | ≥ 2.2.5 < 6.2.16 ≥ 7.2.0 < 7.2.6 = 7.4.0 | 5.5 | — | 2024-10-08 | |
| CVE-2024-31227 | Denial-of-service due to malformed ACL selectors in Redis | ≥ 7.0.0 < 7.2.6 = 7.4.0 | 4.4 | — | 2024-10-08 | |
| CVE-2023-41056 | Redis vulnerable to integer overflow in certain payloads | ≥ 7.0.9 < 7.0.15 ≥ 7.2.0 < 7.2.4 | 8.1 | — | 2024-01-11 | |
| CVE-2023-45145 | Redis Unix-domain socket may have be exposed with the wrong permissions for a short time window. | ≥ 2.6.0 < 6.2.14 ≥ 7.0.0 < 7.0.14 ≥ 7.2.0 < 7.2.2 | 3.6 | — | 2023-10-19 | |
| CVE-2023-41053 | Redis SORT_RO may bypass ACL configuration | ≥ 7.0 < 7.0.13 = 7.2.0 | 3.3 | — | 2023-09-07 | |
| CVE-2021-31294 | Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by sending a non-admin... | < 6.2.0 | 5.9 | — | 2023-07-15 | |
| CVE-2022-24834 | Heap overflow issue with the Lua cjson library used by Redis | ≥ 2.6.0 < 6.0.20 ≥ 6.2.0 < 6.2.13 ≥ 7.0.0 < 7.0.12 | 7.0 | — | 2023-07-13 | |
| CVE-2023-36824 | Heap overflow in COMMAND GETKEYS and ACL evaluation in Redis | ≥ 7.0.0 < 7.0.12 | 7.4 | — | 2023-07-12 | |
| CVE-2023-31655 | redis v7.0.10 was discovered to contain a segmentation violation. This vulnerability allows attackers to cause... | = 7.0.10 | 7.5 | — | 2023-05-18 | |
| CVE-2023-28856 | `HINCRBYFLOAT` can be used to crash a redis-server process | < 6.0.19 ≥ 6.2.0 < 6.2.12 ≥ 7.0.0 < 7.0.11 | 5.5 | — | 2023-04-19 | |
| CVE-2023-28425 | Specially crafted MSETNX command can lead to denial-of-service | ≥ 7.0.8 < 7.0.10 | 5.5 | — | 2023-03-21 | |
| CVE-2023-25155 | Integer Overflow in several Redis commands can lead to denial of service. | < 6.0.18 ≥ 6.2.0 < 6.2.11 ≥ 7.0.0 < 7.0.9 | 5.5 | — | 2023-03-02 | |
| CVE-2022-36021 | Redis string pattern matching can be abused to achieve Denial of Service | < 6.0.18 ≥ 6.2.0 < 6.2.11 ≥ 7.0.0 < 7.0.9 | 5.5 | — | 2023-03-02 | |
| CVE-2022-35977 | Integer overflow in certain command arguments can drive Redis to OOM panic | ≥ 6.0.0 < 6.0.17 ≥ 6.2.0 < 6.2.9 ≥ 7.0.0 < 7.0.8 | 5.5 | — | 2023-01-21 | |
| CVE-2023-22458 | Integer overflow in multiple Redis commands can lead to denial-of-service | ≥ 6.2.0 < 6.2.9 ≥ 7.0.0 < 7.0.8 | 5.5 | — | 2023-01-21 | |
| CVE-2022-3734 | Redis on Windows dbghelp.dll uncontrolled search path | * | 6.3 | — | 2022-10-28 | |
| CVE-2022-3647 | Redis Crash Report debug.c sigsegvHandler denial of service | < 6.2.8 ≥ 7.0.0 < 7.0.6 | 3.1 | — | 2022-10-21 | |
| CVE-2022-35951 | Redis subject to Integer Overflow leading to Remote Code Execution via Heap Overflow | ≥ 7.0.0 < 7.0.5 | 7.0 | — | 2022-09-23 | |
| CVE-2022-31144 | Potential heap overflow in Redis | ≥ 7.0 < 7.0.4 | 7.0 | — | 2022-07-20 | |
| CVE-2022-33105 | Redis v7.0 was discovered to contain a memory leak via the component streamGetEdgeID. | = 7.0 | 7.5 | — | 2022-06-22 | |
| CVE-2022-24736 | A Malformed Lua script can crash Redis | < 6.2.7 = 7.0 | 3.3 | — | 2022-04-28 | |
| CVE-2022-24735 | Lua scripts can be manipulated to overcome ACL rules in Redis | < 6.2.7 = 7.0 | 3.9 | — | 2022-04-28 | |
| CVE-2021-41099 | Integer overflow issue with strings in Redis | ≥ 5.0.0 < 5.0.14 ≥ 6.0.0 < 6.0.16 ≥ 6.2.0 < 6.2.6 | 7.5 | — | 2021-10-05 | |
| CVE-2021-32762 | Integer overflow that can lead to heap overflow in redis-cli, redis-sentinel on some platforms | ≥ 5.0.0 < 5.0.14 ≥ 6.0.0 < 6.0.16 ≥ 6.2.0 < 6.2.6 | 7.5 | — | 2021-10-05 | |
| CVE-2021-32687 | Integer overflow issue with intsets in Redis | ≥ 5.0.0 < 5.0.14 ≥ 6.0.0 < 6.0.16 ≥ 6.2.0 < 6.2.6 | 7.5 | — | 2021-10-05 | |
| CVE-2021-32675 | DoS vulnerability in Redis | ≥ 5.0.0 < 5.0.14 ≥ 6.0.0 < 6.0.16 ≥ 6.2.0 < 6.2.6 | 7.5 | — | 2021-10-05 | |
| CVE-2021-32672 | Vulnerability in Lua Debugger in Redis | ≥ 3.2.0 < 5.0.14 ≥ 6.0.0 < 6.0.16 ≥ 6.2.0 < 6.2.6 | 5.3 | — | 2021-10-05 | |
| CVE-2021-32627 | Integer overflow issue with Streams in Redis | ≥ 5.0.0 < 5.0.14 ≥ 6.0.0 < 6.0.16 ≥ 6.2.0 < 6.2.6 | 7.5 | — | 2021-10-05 | |
| CVE-2021-32628 | Vulnerability in handling large ziplists | ≥ 5.0.0 < 5.0.14 ≥ 6.0.0 < 6.0.16 ≥ 6.2.0 < 6.2.6 | 7.5 | — | 2021-10-05 | |
| CVE-2021-32626 | Lua scripts can overflow the heap-based Lua stack in Redis | ≥ 2.6 < 5.0.14 ≥ 6.0.0 < 6.0.16 ≥ 6.2.0 < 6.2.6 | 7.5 | — | 2021-10-05 |
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
Data: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (see EPSS at https://www.first.org/epss), endoflife.date. Software list: awesome-selfhosted (CC BY-SA 3.0).