CVE-2023-22458

Redis is an in-memory database that persists on disk. Authenticated users can issue a `HRANDFIELD` or `ZRANDMEMBER` command with specially crafted arguments to trigger a denial-of-service by crashing Redis with an assertion failure. This problem affects Redis versions 6.2 or newer up to but not including 6.2.9 as well as versions 7.0 up to but not including 7.0.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-190
• CWE-190

• https://github.com/redis/redis/commit/16f408b1a0121cacd44cbf8aee275d69dc627f02Patch, Third Party Advisory
• https://github.com/redis/redis/releases/tag/6.2.9Release Notes, Third Party Advisory
• https://github.com/redis/redis/releases/tag/7.0.8Release Notes, Third Party Advisory
• https://github.com/redis/redis/security/advisories/GHSA-r8w2-2m53-gprjThird Party Advisory
• https://github.com/redis/redis/commit/16f408b1a0121cacd44cbf8aee275d69dc627f02Patch, Third Party Advisory
• https://github.com/redis/redis/releases/tag/6.2.9Release Notes, Third Party Advisory
• https://github.com/redis/redis/releases/tag/7.0.8Release Notes, Third Party Advisory
• https://github.com/redis/redis/security/advisories/GHSA-r8w2-2m53-gprjThird Party Advisory

Published

Jan 20, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-22452kenny2automate is a Discord bot. In the web interface for se…6.5
• CVE-2023-22453Discourse is an option source discussion platform. Prior to …5.3
• CVE-2023-22454Discourse is an option source discussion platform. Prior to …6.1
• CVE-2023-22455Discourse is an option source discussion platform. Prior to …6.1
• CVE-2023-22456ViewVC, a browser interface for CVS and Subversion version c…6.1
• CVE-2023-22457CKEditor Integration UI adds support for editing wiki pages …8.8
• CVE-2023-2246A vulnerability has been found in SourceCodester Online Pizz…9.8
• CVE-2023-22460go-ipld-prime is an implementation of the InterPlanetary Lin…7.5
• CVE-2023-22461The `sanitize-svg` package, a small SVG sanitizer to prevent…6.1
• CVE-2023-22462Grafana is an open-source platform for monitoring and observ…5.4
• CVE-2023-22463KubePi is a k8s panel. The jwt authentication function of Ku…9.8
• CVE-2023-22464ViewVC is a browser interface for CVS and Subversion version…5.4