Redis

Exploited now

CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.

• 10.0CriticalFeb 18, 2022Debian-specific Redis Servers Auth bypass / access controlCVE-2022-0543Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.Added to KEV Mar 28, 2022 · 37 days after publicationExploited99% likelyExploit codeMetasploit · NucleiDetection

Recent

• 8.8HighMay 5, 2026redis Memory corruptionCVE-2026-23479Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.
• 7.7HighMay 5, 2026redis Memory corruptionCVE-2026-25243Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.4% likelyExploit code
• 6.1MediumMay 5, 2026redis Memory corruptionCVE-2026-23631Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which may lead to remote code execution. A workaround is to prevent users from executing Lua scripts or avoid using replicas where replica-read-only is disabled. This is patched in version 8.6.3.3.1% likely
• 8.8HighNov 4, 2025redis Code / command injectionCVE-2025-62507Redis is an open source, in-memory database that persists on disk. In versions 8.2.0 and above, a user can run the XACKDEL command with multiple ID's and trigger a stack buffer overflow, which may potentially lead to remote code execution. This issue is fixed in version 8.2.3. To workaround this issue without patching the redis-server executable is to prevent users from executing XACKDEL operation. This can be done using ACL to restrict XACKDEL command.7.5% likely
• 7.0HighOct 7, 2024redis Code / command injectionCVE-2024-31449Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.4.5% likelyExploit code
• 10.0CriticalFeb 18, 2022Debian-specific Redis Servers Auth bypass / access controlCVE-2022-0543Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.Exploited99% likelyExploit codeMetasploit · NucleiDetection

See every Redis entry on the dashboard.

Top products

• redis3 CVEs in the last year

Advisories

Official advisories from the last 90 days that name this vendor's CVEs.

• CCCS (Canada) · Oct 19, 2026Redis security advisory (AV26-423) - Update 1CVE-2026-23631CVE-2026-25243