What’s Vulnerable › Vulnerabilities

CVE-2018-12326

• Severity: high (CVSS 8.4 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-06-17 · updated 2026-06-17
• Weakness: CWE-119

Description

Buffer overflow in redis-cli of Redis before 4.0.10 and 5.x before 5.0 RC3 allows an attacker to achieve code execution and escalate to higher privileges via a crafted command line. NOTE: It is unclear whether there are any common situations in which redis-cli is used with, for example, a -h (aka hostname) argument from an untrusted source.

Affected products

• Redis Labs Redis: before 4.0.10; 5.0-rc1, 5.0-rc2 — fixed in 4.0.10

How to fix

Upgrade to a fixed version: Redis Labs Redis 4.0.10. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2019:0052
• https://access.redhat.com/errata/RHSA-2019:0094
• https://access.redhat.com/errata/RHSA-2019:1860
• https://gist.github.com/fakhrizulkifli/f831f40ec6cde4f744c552503d8698f0
• https://github.com/antirez/redis/commit/9fdcc15962f9ff4baebe6fdd947816f43f730d50
• https://raw.githubusercontent.com/antirez/redis/4.0/00-RELEASENOTES
• https://raw.githubusercontent.com/antirez/redis/5.0/00-RELEASENOTES
• https://www.exploit-db.com/exploits/44904/
• https://access.redhat.com/errata/RHSA-2019:0052
• https://access.redhat.com/errata/RHSA-2019:0094
• https://access.redhat.com/errata/RHSA-2019:1860
• https://gist.github.com/fakhrizulkifli/f831f40ec6cde4f744c552503d8698f0

Get alerted when CVE-2018-12326 or the next vulnerability affects your stack