{"id":"CVE-2019-10193","aliases":["ALPINE-CVE-2019-10193","BELL-CVE-2019-10193","DEBIAN-CVE-2019-10193","DSA-4480-1","EUVD-2019-2216","GHSA-7c9p-23p9-r8x2","MGASA-2019-0226","RHSA-2019:1819","RHSA-2019:2002","RLSA-2019:2002"],"status":"published","title":"A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions...","description":"A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By corrupting a hyperloglog using the SETRANGE command, an attacker could cause Redis to perform controlled increments of up to 12 bytes past the end of a stack-allocated buffer.","severity":{"version":"3.0","score":7.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.23304,"percentile":0.97793,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-121","CWE-787"],"published":"2019-07-11T00:00:00Z","modified":"2026-10-24T10:30:50Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"redis","fixed_in":["5.0.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"redis","fixed_in":["5.0.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"redis","fixed_in":["5.0.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"redis","fixed_in":["5.0.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"redis","fixed_in":["5.0.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"redis","fixed_in":["5.0.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"redis","fixed_in":["5.0.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"redis","fixed_in":["5.0.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"redis","fixed_in":["5.0.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"redis","fixed_in":["5.0.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"redis","fixed_in":["4.0.14-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"redis","fixed_in":["4.0.14-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"redis","fixed_in":["4.0.14-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"redis","fixed_in":["5:5.0.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"redis","fixed_in":["5:5.0.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"redis","fixed_in":["5:5.0.4-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"5.0.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"5.0.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"5.0.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"5.0.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"5.0.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"5.0.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"5.0.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"5.0.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"5.0.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"5.0.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"4.0.14-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"4.0.14-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"4.0.14-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.0.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.0.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.0.4-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:3.2.6-3+deb9u3"}]}],"versions":["3:3.2.6-1","3:3.2.6-2","3:3.2.6-3","3:3.2.6-3+deb9u1","3:3.2.6-3+deb9u2"],"bundled":2},{"source":"osv","ecosystem":"Debian:10","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.0.3-4+deb10u1"}]}],"versions":["5:5.0.3-4"],"bundled":2},{"source":"osv","ecosystem":"Mageia:6","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.14-1.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-redis5-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.5-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-redis5-redis-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.5-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.3-2.module+el8.0.0.z+3657+acb471dc"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"redis-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.3-2.module+el8.0.0.z+3657+acb471dc"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"redis-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.3-2.module+el8.0.0.z+3657+acb471dc"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"redis-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.3-2.module+el8.0.0.z+3657+acb471dc"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"redis-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.3-2.module+el8.0.0.z+3657+acb471dc"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.3-2.module+el8.4.0+393+5af13779"}]}],"bundled":2}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"oracle","product":"communications_operations_monitor"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"enterprise_linux_eus"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_tus"},{"vendor":"redhat","product":"openstack"},{"vendor":"redis","product":"redis"},{"vendor":"redis labs","product":"redis"},{"vendor":"redislabs","product":"redis"}],"references":[{"url":"https://www.debian.org/security/2019/dsa-4480","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://seclists.org/bugtraq/2019/Jul/19","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4061-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.securityfocus.com/bid/109290","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1819","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2002","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201908-04","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://raw.githubusercontent.com/antirez/redis/3.2/00-RELEASENOTES","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","advisory","article"]},{"url":"https://raw.githubusercontent.com/antirez/redis/4.0/00-RELEASENOTES","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","advisory","article"]},{"url":"https://raw.githubusercontent.com/antirez/redis/5.0/00-RELEASENOTES","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","advisory","article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10193","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10193","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7c9p-23p9-r8x2"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-10193","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-10193","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-10193","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0226.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25278","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1723918","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1727668","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1819.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10192","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10192","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10192","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10193","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10193","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2002.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2019:2002","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-10193","description":"A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By corrupting a hyperloglog using the SETRANGE command, an attacker could cause Redis to perform controlled increments of up to 12 bytes past the end of a stack-allocated buffer.","status":"published","published":"2019-07-11T18:30:33Z","modified":"2024-08-04T22:17:18.421Z","cvss":[{"version":"3.0","score":7.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:20:18.746972Z"}],"euvd":[{"id":"EUVD-2019-2216","description":"A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By corrupting a hyperloglog using the SETRANGE command, an attacker could cause Redis to perform controlled increments of up to 12 bytes past the end of a stack-allocated buffer.","status":"published","published":"2019-07-11T18:30:33Z","modified":"2024-08-04T22:17:18Z","cvss":[{"version":"3.0","score":7.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T02:40:53.61807Z"}],"ghsa":[{"id":"GHSA-7c9p-23p9-r8x2","title":"A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions...","description":"A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By corrupting a hyperloglog using the SETRANGE command, an attacker could cause Redis to perform controlled increments of up to 12 bytes past the end of a stack-allocated buffer.","status":"published","published":"2022-05-24T16:50:03Z","modified":"2023-01-28T05:05:48Z","cwes":["CWE-119","CWE-787"],"updated_at":"2026-11-02T14:44:22.854564Z"}],"nvd":[{"id":"CVE-2019-10193","description":"A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By corrupting a hyperloglog using the SETRANGE command, an attacker could cause Redis to perform controlled increments of up to 12 bytes past the end of a stack-allocated buffer.","status":"published","published":"2019-07-11T19:15:12.72Z","modified":"2026-06-17T02:10:27.643Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":7.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-121","CWE-787"],"updated_at":"2026-11-02T14:05:19.195714Z"}],"osv":[{"id":"ALPINE-CVE-2019-10193","description":"A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By corrupting a hyperloglog using the SETRANGE command, an attacker could cause Redis to perform controlled increments of up to 12 bytes past the end of a stack-allocated buffer.","status":"published","published":"2019-07-11T19:15:12.72Z","modified":"2026-09-21T06:17:52.449540248Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:47.663013Z"},{"id":"BELL-CVE-2019-10193","title":"CVE-2019-10193 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:33.216401Z","modified":"2026-01-26T09:49:06.782753Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2019-10193","description":"A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By corrupting a hyperloglog using the SETRANGE command, an attacker could cause Redis to perform controlled increments of up to 12 bytes past the end of a stack-allocated buffer.","status":"published","published":"2019-07-11T19:15:12.72Z","modified":"2026-10-24T10:30:50.899381306Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:10.383287Z"},{"id":"DEBIAN-CVE-2019-10193","description":"A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By corrupting a hyperloglog using the SETRANGE command, an attacker could cause Redis to perform controlled increments of up to 12 bytes past the end of a stack-allocated buffer.","status":"published","published":"2019-07-11T19:15:12.72Z","modified":"2026-09-21T07:00:50.122161578Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.170944Z"},{"id":"RHSA-2019:1819","title":"Red Hat Security Advisory: rh-redis5-redis security update","status":"published","published":"2024-09-13T19:52:56Z","modified":"2026-06-29T10:25:34Z","cvss":[{"version":"3.0","score":7.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"RHSA-2019:2002","title":"Red Hat Security Advisory: redis:5 security update","status":"published","published":"2024-09-13T19:52:44Z","modified":"2026-06-29T10:25:46Z","cvss":[{"version":"3.0","score":7.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"RLSA-2019:2002","title":"Important: redis:5 security update","description":"Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.\n\nSecurity Fix(es):\n\n* redis: Heap buffer overflow in HyperLogLog triggered by malicious client (CVE-2019-10192)\n\n* redis: Stack buffer overflow in HyperLogLog triggered by malicious client (CVE-2019-10193)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2019-08-07T10:40:54Z","modified":"2026-02-04T13:45:09.381158Z","cvss":[{"version":"3.0","score":7.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"DSA-4480-1","title":"redis - security update","status":"published","published":"2019-07-11T00:00:00Z","modified":"2026-03-09T02:08:50.507176Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2019-0226","title":"Updated redis packages fix security vulnerabilities","description":"This update fixes 2 security issues.\n\nA heap-buffer overflow vulnerability was found in the Redis hyperloglog\ndata structure (CVE-2019-10192).\n\nA stack-buffer overflow vulnerability was found in the Redis hyperloglog\ndata structure (CVE-2019-10193).\n","status":"published","published":"2019-08-18T12:39:41Z","modified":"2026-04-16T04:40:37.080391541Z","updated_at":"2026-11-02T15:49:40.793816Z"}]}}