CVE-2017-1000248

redis-store deserializes untrusted data

9.8 CriticalFix available

Redis-store <=v1.3.0 allows unsafe objects to be loaded from redis

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.98%Up 1.6 points since Apr 14, 2021

What each source reports

NVD Score used 9.8

Redis-store <=v1.3.0 allows unsafe objects to be loaded from redis

Record: CVE-2017-1000248
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-502
Updated: 2026-11-02

CVE List No score

Redis-store <=v1.3.0 allows unsafe objects to be loaded from redis

Record: CVE-2017-1000248
Updated: 2026-11-02

EUVDEUVD-2017-0357 No score

Redis-store <=v1.3.0 allows unsafe objects to be loaded from redis

Record: EUVD-2017-0357
Updated: 2026-11-03

GitHub AdvisoriesGHSA-2w67-526p-gm73 9.8

redis-store deserializes untrusted data

Redis-store prior to 1.4.0 allows unsafe objects to be loaded from redis

Record: GHSA-2w67-526p-gm73
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

OSV 9.8

Redis-store <=v1.3.0 allows unsafe objects to be loaded from redis

Record: CVE-2017-1000248
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2017-1000248 9.8

Redis-store <=v1.3.0 allows unsafe objects to be loaded from redis

Record: DEBIAN-CVE-2017-1000248
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-2w67-526p-gm73 9.8

redis-store deserializes untrusted data

Redis-store prior to 1.4.0 allows unsafe objects to be loaded from redis

Record: GHSA-2w67-526p-gm73
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

OSVUBUNTU-CVE-2017-1000248 9.8

Redis-store <=v1.3.0 allows unsafe objects to be loaded from redis

Record: UBUNTU-CVE-2017-1000248
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

redis-store

Affected packages

Affected packages
Package	Affected	Fixed
`redis-store` RubyGems	before 1.4.0	1.4.0
`ruby-redis-store` Debian:12	before 1.1.6-2	1.1.6-2
`ruby-redis-store` Debian:13	before 1.1.6-2	1.1.6-2
`ruby-redis-store` Debian:14	before 1.1.6-2	1.1.6-2
`redis-store` RubyGems	before 1.4.0, plus listed versions 0.3.60.3.70.3.80.3.91.0.0.1 Show 19 moreShow less 1.0.0.beta11.0.0.beta21.0.0.beta31.0.0.beta41.0.0.beta51.0.0.rc11.1.01.1.0.rc1.1.0.rc21.1.11.1.21.1.31.1.41.1.51.1.61.1.71.2.01.2.0.pre1.3.0	1.4.0
`ruby-redis-store` Ubuntu:16.04:LTS	before 1.1.6-1+deb9u1build0.16.04.1, plus listed versions 1.1.6-1	1.1.6-1+deb9u1build0.16.04.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-1000248 is a critical vulnerability (CVSS 9.8) in Redis-store, published November 17, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.98%, the 80th percentile. Fixed in redis-store 1.4.0.

Attack profile

How easy it is to exploit

What an attacker can affect

Exploit likelihood

What each source reports

Affected products

Affected packages

History

In short

References