CVE-2024-46981
Last modified
CVE-2024-46981 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. EPSS estimates a 7.80% chance of exploitation in the next 30 days.
Description
Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem is fixed in 7.4.2, 7.2.7, and 6.2.17. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Redis | Redis | >= 6.2.0, < 6.2.17 |
| Redis | Redis | >= 7.2.0, < 7.2.7 |
| Redis | Redis | >= 7.4.0, < 7.4.2 |
| Debian | Debian Linux | 11.0 |
References
- https://github.com/redis/redis/releases/tag/6.2.17Release Notes
- https://github.com/redis/redis/releases/tag/7.2.7Release Notes
- https://github.com/redis/redis/releases/tag/7.4.2Release Notes
- https://lists.debian.org/debian-lts-announce/2025/01/msg00018.htmlMailing List, Third Party Advisory
- https://www.vicarius.io/vsociety/posts/cve-2024-46981-detect-redis-vulnerabilityExploit, Third Party Advisory
- https://www.vicarius.io/vsociety/posts/cve-2024-46981-mitigate-redis-vulnerabilityExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-46981?
How severe is CVE-2024-46981?
How do I fix CVE-2024-46981?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-46976Backstage is an open framework for building developer portal…5.4
- CVE-2024-46977OpenC3 COSMOS provides the functionality needed to send comm…6.5
- CVE-2024-46978XWiki Platform is a generic wiki platform offering runtime s…6.5
- CVE-2024-46979XWiki Platform is a generic wiki platform offering runtime s…5.3
- CVE-2024-4698The Testimonial Carousel For Elementor plugin for WordPress …6.4
- CVE-2024-46980Tuleap is a tool for end to end traceability of application …4.8
- CVE-2024-46982Next.js is a React framework for building full-stack web app…7.5
- CVE-2024-46983sofa-hessian is an internal improved version of Hessian3/4 p…9.8
- CVE-2024-46984The reference validator is a tool to perform advanced valida…9.8
- CVE-2024-46985DataEase is an open source data visualization analysis tool.…7.5
- CVE-2024-46986Camaleon CMS is a dynamic and advanced content management sy…9.9
- CVE-2024-46987Camaleon CMS is a dynamic and advanced content management sy…7.7
Are you affected by CVE-2024-46981?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST