What’s Vulnerable › Products
Redis vulnerabilities
49 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 17 published in the last 12 months.
Check whether your Redis version is affected
Exploited Redis vulnerabilities
- CVE-2022-0543 — Debian-specific Redis Server Lua Sandbox Escape Vulnerability
Latest Redis vulnerabilities
- CVE-2026-81934 — Redis TLS pending-data list use-after-free (CVSS 7.1)
- CVE-2026-66373 — (CVSS 7.5)
- CVE-2026-25243 — redis-server RESTORE invalid memory access may allow remote code execution (CVSS 8.8)
- CVE-2026-23631 — redis-server Lua use-after-free may allow remote code execution (CVSS 8.1)
- CVE-2026-23479 — redis-server use-after-free in unblock client flow may allow remote code execution (CVSS 8.8)
- CVE-2025-62507 — Redis: Bug in XACKDEL may lead to stack overflow and potential RCE (CVSS 8.8)
- CVE-2025-49844 — Redis Lua Use-After-Free may lead to remote code execution (CVSS 9.9)
- CVE-2025-46819 — Redis is vulnerable to DoS via specially crafted LUA scripts (CVSS 7.1)
- CVE-2025-46818 — Redis: Authenticated users can execute LUA scripts as a different user (CVSS 7.3)
- CVE-2025-46817 — Lua library commands may lead to integer overflow and potential RCE (CVSS 8.8)
- CVE-2025-46686 — (CVSS 3.5)
- CVE-2025-48367 — Redis DoS Vulnerability due to bad connection error handling (CVSS 7.5)
- CVE-2025-32023 — Redis allows out of bounds writes in hyperloglog commands leading to RCE (CVSS 7.8)
- CVE-2025-27151 — redis-check-aof may lead to stack overflow and potential RCE (CVSS 9.8)
- CVE-2025-21605 — Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client (CVSS 7.5)
- CVE-2024-51741 — Redis allows denial-of-service due to malformed ACL selectors (CVSS 4.4)
- CVE-2024-46981 — Redis' Lua library commands may lead to remote code execution (CVSS 9.8)
- CVE-2024-31449 — Lua library commands may lead to stack overflow and RCE in Redis (CVSS 8.8)
- CVE-2024-31228 — Denial-of-service due to unbounded pattern matching in Redis (CVSS 6.5)
- CVE-2024-31227 — Denial-of-service due to malformed ACL selectors in Redis (CVSS 4.4)
- CVE-2023-41056 — Redis vulnerable to integer overflow in certain payloads (CVSS 8.1)
- CVE-2023-45145 — Redis Unix-domain socket may have be exposed with the wrong permissions for a short time window. (CVSS 3.6)
- CVE-2023-41053 — Redis SORT_RO may bypass ACL configuration (CVSS 3.3)
- CVE-2021-31294 — (CVSS 5.9)
- CVE-2022-24834 — Heap overflow issue with the Lua cjson library used by Redis (CVSS 8.8)