CVE-2023-28856

Redis is an open source, in-memory database that persists on disk. Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that will crash Redis on access in affected versions. This issue has been addressed in in versions 7.0.11, 6.2.12, and 6.0.19. Users are advised to upgrade. There are no known workarounds for this issue.

• CWE-20
• CWE-617
• CWE-617

• https://github.com/redis/redis/commit/bc7fe41e5857a0854d524e2a63a028e9394d2a5cPatch
• https://github.com/redis/redis/pull/11149Issue Tracking, Patch
• https://github.com/redis/redis/security/advisories/GHSA-hjv8-vjf6-wcr6Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2023/04/msg00023.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EQ4DJSO4DMR55AWK6OPVJH5UTEB35R2Z/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LPUTH7NBQTZDVJWFNUD24ZCS6NDUFYS6/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OQGKMKSQE67L32HE6W5EI2I2YKW5VWHI/Mailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20230601-0007/
• https://github.com/redis/redis/commit/bc7fe41e5857a0854d524e2a63a028e9394d2a5cPatch
• https://github.com/redis/redis/pull/11149Issue Tracking, Patch
• https://github.com/redis/redis/security/advisories/GHSA-hjv8-vjf6-wcr6Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2023/04/msg00023.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EQ4DJSO4DMR55AWK6OPVJH5UTEB35R2Z/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LPUTH7NBQTZDVJWFNUD24ZCS6NDUFYS6/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OQGKMKSQE67L32HE6W5EI2I2YKW5VWHI/Mailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20230601-0007/

Published

Apr 18, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-28850Pimcore Perspective Editor provides an editor for Pimcore th…5.4
• CVE-2023-28851Silverstripe Form Capture provides a method to capture simpl…5.4
• CVE-2023-28852GLPI is a free asset and IT management software package. Sta…4.8
• CVE-2023-28853Mastodon is a free, open-source social network server based …6.5
• CVE-2023-28854nophp is a PHP web framework. Prior to version 0.0.1, nophp …8.8
• CVE-2023-28855Fields is a GLPI plugin that allows users to add custom fiel…6.5
• CVE-2023-28857Apereo CAS is an open source multilingual single sign-on sol…7.5
• CVE-2023-28858redis-py before 4.5.3 leaves a connection open after canceli…3.7
• CVE-2023-28859redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connec…6.5
• CVE-2023-2886Missing Origin Validation in WebSockets vulnerability in CBO…4.3
• CVE-2023-28862An issue was discovered in LemonLDAP::NG before 2.16.1. Weak…9.8
• CVE-2023-28863AMI MegaRAC SPx12 and SPx13 devices have Insufficient Verifi…9.1