RE
Database
Redis
On CISA KEVExploited in the wild
71
CVEs
1
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 10High 41Medium 15Low 4
Watch
Add Redis to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-25243 | 8.8 | May 5 | redis-server RESTORE invalid memory access may allow remote code execution Affected: < 8.6.3 |
| CVE-2026-23479 | 8.8 | May 5 | redis-server use-after-free in unblock client flow may allow remote code execution Affected: >= 7.2.0, < 8.6.3 |
| CVE-2025-62507 | 8.8 | Nov 4 | Redis is an open source, in-memory database that persists on disk Affected: 8.2.0 before 8.2.3 |
| CVE-2025-46817 | 8.8 | Oct 3 | Redis is an open source, in-memory database that persists on disk Affected: before 6.2.20; 7.0 before 7.2.11; 7.4.0 before 7.4.6; 8.0.0 before 8.0.4; 8.2.0 before 8.2.2 |
| CVE-2024-31449 | 8.8 | Oct 7 | Redis is an open source, in-memory database that persists on disk Affected: 2.8.18 before 6.2.16; 7.2.0 before 7.2.6; 7.4.0; 7.4.0; 7.4.0 |
| CVE-2022-24834 | 8.8 | Jul 13 | Redis is an in-memory database that persists on disk Affected: 2.6.0 before 6.0.20; 6.2.0 before 6.2.13; 7.0.0 before 7.0.12 |
| CVE-2023-36824 | 8.8 | Jul 11 | Redis is an in-memory database that persists on disk Affected: 7.0.0 before 7.0.12 |
| CVE-2022-31144 | 8.8 | Jul 19 | Redis is an in-memory database that persists on disk Affected: 7.0 before 7.0.4 |
| CVE-2021-32762 | 8.8 | Oct 4 | Redis is an open source, in-memory database that persists on disk Affected: 5.0.0 before 5.0.14; 6.0.0 before 6.0.16; 6.2.0 before 6.2.6 |
| CVE-2021-32626 | 8.8 | Oct 4 | Redis is an open source, in-memory database that persists on disk Affected: 2.6 before 5.0.14; 6.0.0 before 6.0.16; 6.2.0 before 6.2.6 |
| CVE-2021-32625 | 8.8 | Jun 2 | Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker Affected: 6.0.0 before 6.0.14; 6.2.0 before 6.2.4 |
| CVE-2021-29478 | 8.8 | May 4 | Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker Affected: 6.2.0 before 6.2.3 |
| CVE-2021-29477 | 8.8 | May 4 | Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker Affected: 6.0.0 before 6.0.13; 6.2.0 before 6.2.3 |
| CVE-2021-21309 | 8.8 | Feb 26 | Redis is an open-source, in-memory database that persists on disk Affected: 4.0 before 5.0.11; 6.0.0 before 6.0.11 |
| CVE-2018-12326 | 8.4 | Jun 17 | Buffer overflow in redis-cli of Redis before 4.0.10 and 5.x before 5.0 RC3 allows an attacker to achieve code execution and escalate to higher privileges via a crafted command… Affected: before 4.0.10; 5.0; 5.0 |
| CVE-2026-23631 | 8.1 | May 5 | redis-server Lua use-after-free may allow remote code execution Affected: < 8.6.3 |
| CVE-2023-41056 | 8.1 | Jan 10 | Redis is an in-memory database that persists on disk Affected: 7.0.9 before 7.0.15; 7.2.0 before 7.2.4 |
| CVE-2025-32023 | 7.8 | Jul 7 | Redis is an open source, in-memory database that persists on disk Affected: 2.8.0 before 6.2.19; 7.2.0 before 7.2.10; 7.4.0 before 7.4.5; 8.0.0 before 8.0.3 |
| CVE-2022-24735 | 7.8 | Apr 27 | Redis is an in-memory database that persists on disk Affected: before 6.2.7; 7.0; 7.0; 7.0 |
| CVE-2020-14147 | 7.7 | Jun 15 | An integer overflow in the getnum function in lua_struct.c in Redis before 6.0.3 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a… Affected: before 5.0.9; 6.0.0 before 6.0.3 |
| CVE-2026-66373 | 7.5 | Jul 25 | Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry)… Affected: before 8.8.0 |
| CVE-2025-48367 | 7.5 | Jul 7 | Redis is an open source, in-memory database that persists on disk Affected: before 6.2.19; 7.0 before 7.2.10; 7.4.0 before 7.4.5; 8.0.0 before 8.0.3 |
| CVE-2025-21605 | 7.5 | Apr 23 | Redis is an open source, in-memory database that persists on disk Affected: 2.6.0 before 6.2.18; 7.0 before 7.2.8; 7.4.0 before 7.4.3 |
| CVE-2023-31655 | 7.5 | May 18 | redis v7.0.10 was discovered to contain a segmentation violation Affected: 7.0.10 |
| CVE-2022-33105 | 7.5 | Jun 23 | Redis v7.0 was discovered to contain a memory leak via the component streamGetEdgeID Affected: 7.0 |
| CVE-2021-41099 | 7.5 | Oct 4 | Redis is an open source, in-memory database that persists on disk Affected: 5.0.0 before 5.0.14; 6.0.0 before 6.0.16; 6.2.0 before 6.2.6 |
| CVE-2021-32687 | 7.5 | Oct 4 | Redis is an open source, in-memory database that persists on disk Affected: 5.0.0 before 5.0.14; 6.0.0 before 6.0.16; 6.2.0 before 6.2.6 |
| CVE-2021-32675 | 7.5 | Oct 4 | Redis is an open source, in-memory database that persists on disk Affected: 5.0.0 before 5.0.14; 6.0.0 before 6.0.16; 6.2.0 before 6.2.6 |
| CVE-2021-32628 | 7.5 | Oct 4 | Redis is an open source, in-memory database that persists on disk Affected: 5.0.0 before 5.0.14; 6.0.0 before 6.0.16; 6.2.0 before 6.2.6 |
| CVE-2021-32627 | 7.5 | Oct 4 | Redis is an open source, in-memory database that persists on disk Affected: 5.0.0 before 5.0.14; 6.0.0 before 6.0.16; 6.2.0 before 6.2.6 |
| CVE-2020-21468 | 7.5 | Sep 20 | A segmentation fault in the redis-server component of Redis 5.0.7 leads to a denial of service (DOS) Affected: 5.0.7 |
| CVE-2021-32761 | 7.5 | Jul 21 | Redis is an in-memory database that persists on disk Affected: 2.2.0 before 5.0.13; 6.0 before 6.0.15; 6.2.0 before 6.2.5 |
| CVE-2021-29469 | 7.5 | Apr 23 | Node-redis is a Node.js Redis client Affected: before 3.1.1 |
| CVE-2018-12453 | 7.5 | Jun 16 | Type confusion in the xgroupCommand function in t_stream.c in redis-server in Redis before 5.0 allows remote attackers to cause denial-of-service via an XGROUP command in which… Affected: before 5.0 |
| CVE-2015-8080 | 7.5 | Apr 13 | Integer overflow in the getnum function in lua_struct.c in Redis 2.8.x before 2.8.24 and 3.0.x before 3.0.6 allows context-dependent attackers with permission to run Lua code in a… Affected: 2.8.0 before 2.8.24; 3.0.0 before 3.0.6; 5.0.0 before 5.0.8 |
| CVE-2016-10517 | 7.4 | Oct 24 | networking.c in Redis before 3.2.7 allows "Cross Protocol Scripting" because it lacks a check for POST and Host: strings, which are not valid in the Redis protocol (but commonly… Affected: before 3.2.7 |
| CVE-2025-46818 | 7.3 | Oct 3 | Redis is an open source, in-memory database that persists on disk Affected: before 6.2.20; 7.0 before 7.2.11; 7.4.0 before 7.4.6; 8.0.0 before 8.0.4; 8.2.0 before 8.2.2 |
| CVE-2019-10193 | 7.2 | Jul 11 | A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4 Affected: 3.0.0 before 3.2.13; 4.0.0 before 4.0.14; 5.0 before 5.0.4 |
| CVE-2019-10192 | 7.2 | Jul 11 | A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4 Affected: 3.0.0 before 3.2.13; 4.0.0 before 4.0.14; 5.0 before 5.0.4 |
| CVE-2026-81934 | 7.1 | Aug 27 | Redis TLS pending-data list use-after-free Affected: before 8.2.0-46; before 8.0.20-96; before 7.22.2-179; before 7.8.6-303 |
| CVE-2025-46819 | 7.1 | Oct 3 | Redis is an open source, in-memory database that persists on disk Affected: before 6.2.20; 7.0 before 7.2.11; 7.4.0 before 7.4.6; 8.0.0 before 8.0.4; 8.2.0 before 8.2.2 |
Showing 41
