CVE-2022-24834

Name: CVE-2022-24834
Creator: NVD / NIST
Published: 2023-07-13T15:15:08.817+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 8.8/10EPSS 42.92%

Last modified Jun 17, 2026

CVE-2022-24834 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. EPSS estimates a 42.92% chance of exploitation in the next 30 days.

Description

Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. The problem is fixed in versions 7.0.12, 6.2.13, and 6.0.20.

Metrics

CVSS 3.1

8.8/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

42.92%

98.6th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Redis	Redis	>= 2.6.0, < 6.0.20
Redis	Redis	>= 6.2.0, < 6.2.13
Redis	Redis	>= 7.0.0, < 7.0.12
Fedoraproject	Fedora	37
Fedoraproject	Fedora	38

References

https://github.com/redis/redis/security/advisories/GHSA-p8x2-9v9q-c838Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MIF5MAGYARYUMRFK7PQI7HYXMK2HZE5T/Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TDNNH2ONMVNBQ6LUIAOAGDNFPKXNST5K/Mailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20230814-0006/
https://github.com/redis/redis/security/advisories/GHSA-p8x2-9v9q-c838Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MIF5MAGYARYUMRFK7PQI7HYXMK2HZE5T/Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TDNNH2ONMVNBQ6LUIAOAGDNFPKXNST5K/Mailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20230814-0006/

Timeline

Published: Jul 13, 2023
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2022-24834?

How severe is CVE-2022-24834?

CVE-2022-24834 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 42.92% probability of exploitation in the next 30 days.

How do I fix CVE-2022-24834?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-24834?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST