{"id":"CVE-2024-31227","aliases":["ALPINE-CVE-2024-31227","ALSA-2024:10869","AZL-52008","BELL-CVE-2024-31227","BIT-keydb-2024-31227","BIT-redis-2024-31227","BIT-valkey-2024-31227","DEBIAN-CVE-2024-31227","EUVD-2024-29123","GHSA-38p4-26x2-vqhh","MGASA-2024-0340","RHSA-2024:10869","SUSE-SU-2024:3535-1","SUSE-SU-2024:3537-1","SUSE-SU-2024:3549-1","UBUNTU-CVE-2024-31227","openSUSE-SU-2024:14412-1","openSUSE-SU-2025:15293-1"],"status":"published","title":"Denial-of-service due to malformed ACL selectors in Redis","description":"Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem exists in Redis 7 prior to versions 7.2.6 and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.","severity":{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00398,"percentile":0.34521,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2024-10-07T08:53:16Z","modified":"2026-11-02T12:01:51Z","fixes":[{"ecosystem":"Alpine:v3.17","package":"redis","fixed_in":["7.0.15-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"redis","fixed_in":["7.0.15-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"redis","fixed_in":["7.2.4-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"valkey","fixed_in":["7.2.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"valkey","fixed_in":["7.2.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"valkey","fixed_in":["7.2.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"valkey","fixed_in":["7.2.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"valkey","fixed_in":["7.2.7-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"valkey","fixed_in":["8.0.1-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"redis","fixed_in":["7.0.15-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"redis","fixed_in":["7.2.5-r1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"redis","fixed_in":["7.2.8","7.4.1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"valkey","fixed_in":["7.2.7","8.0.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"redict","fixed_in":["7.3.1+ds-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"redis","fixed_in":["5:7.0.15-1~deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"redis","fixed_in":["5:7.0.15-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"redis","fixed_in":["5:7.0.15-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"valkey","fixed_in":["8.0.1+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"valkey","fixed_in":["8.0.1+dfsg1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.15-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.15-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.2.4-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.7-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.6-1.module_el9.5.0+130+36ae7635"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"redis-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.6-1.module_el9.5.0+130+36ae7635"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"redis-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.6-1.module_el9.5.0+130+36ae7635"}]}],"bundled":5},{"source":"osv","ecosystem":"Azure Linux:3","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.15-r0"},{"fixed":"7.0.15-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.2.5-r0"},{"fixed":"7.2.5-r1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"keydb","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"redis","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.2.8"},{"introduced":"7.3.0"},{"fixed":"7.4.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"valkey","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.2.7"},{"introduced":"8.0.0"},{"fixed":"8.0.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"redict","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.1+ds-1"}]}],"versions":["7.3.0+ds-1","7.3.0+ds-2","7.3.0+ds-3","7.3.0+ds-3~bpo12+1"]},{"source":"osv","ecosystem":"Debian:12","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:7.0.15-1~deb12u2"}]}],"versions":["5:7.0.11-1","5:7.0.11-1+deb12u1","5:7.0.12-1","5:7.0.12-2","5:7.0.13-1","5:7.0.13-2","5:7.0.14-1","5:7.0.14-2","5:7.0.15-1~deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:7.0.15-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:7.0.15-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.14-1.1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.6-1.module+el9.5.0+22422+63e067d8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.6-1.module+el9.5.0+22422+63e067d8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.6-1.module+el9.5.0+22422+63e067d8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.6-1.module+el9.5.0+22422+63e067d8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.6-1.module+el9.5.0+22422+63e067d8"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.4-150600.3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.4-150600.3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"redis7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8-150600.8.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"redis7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8-150600.8.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"redis7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8-150500.3.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"redis7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8-150500.3.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5:7.0.12-1","5:7.0.14-1","5:7.0.14-2","5:7.0.15-1","5:7.0.15-1build1","5:7.0.15-1build2","5:7.0.15-1ubuntu0.24.04.1","5:7.0.15-1ubuntu0.24.04.2","5:7.0.15-1ubuntu0.24.04.3","5:7.0.15-1ubuntu0.24.04.4","5:7.0.15-1ubuntu0.24.04.5"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.2-1.1"}]}],"bundled":7}],"products":[{"vendor":"redis","product":"redis"}],"references":[{"url":"https://github.com/redis/redis/security/advisories/GHSA-38p4-26x2-vqhh","tags":["x_refsource_CONFIRM","Third Party Advisory","advisory","article","report"]},{"url":"https://github.com/redis/redis/commit/b351d5a3210e61cc3b22ba38a723d6da8f3c298a","tags":["x_refsource_MISC","Patch","fix","article","report"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-31227","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:10869","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-41053","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45145","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-31227","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-31228","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-31449","tags":["report"]},{"url":"https://bugzilla.redhat.com/2237826","tags":["report"]},{"url":"https://bugzilla.redhat.com/2244940","tags":["report"]},{"url":"https://bugzilla.redhat.com/2317053","tags":["report"]},{"url":"https://bugzilla.redhat.com/2317056","tags":["report"]},{"url":"https://bugzilla.redhat.com/2317058","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-10869.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31227","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-31227","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31227.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-31227","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0340.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33643","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EMP3URK6CE4LGQZ7V2GD23UVMTFM7K46/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2237826","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2244940","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2317053","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2317056","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2317058","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-26628","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10869.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-41053","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41053","tags":["advisory"]},{"url":"https://github.com/redis/redis/commit/9e505e6cd842338424e05883521ca1fb7d0f47f6","tags":["article"]},{"url":"https://github.com/redis/redis/security/advisories/GHSA-q4jr-5p56-4xwc","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45145","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45145","tags":["advisory"]},{"url":"https://github.com/redis/redis/security/advisories/GHSA-ghmp-889m-7cvx","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-31227","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-31228","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31228","tags":["advisory"]},{"url":"https://github.com/redis/redis/commit/9317bf64659b33166a943ec03d5d9b954e86afb0","tags":["article"]},{"url":"https://github.com/redis/redis/security/advisories/GHSA-66gq-c942-6976","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-31449","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31449","tags":["advisory"]},{"url":"https://github.com/redis/redis/commit/1f7c148be2cbacf7d50aa461c58b871e87cc5ed9","tags":["article"]},{"url":"https://github.com/redis/redis/security/advisories/GHSA-whxg-wx83-85p5","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243535-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1231264","tags":["report"]},{"url":"https://bugzilla.suse.com/1231265","tags":["report"]},{"url":"https://bugzilla.suse.com/1231266","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31228","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31449","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243537-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243549-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-31227","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FC3R4QUTZLEWJMAPH3UHB3OKNYMNYUZM/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-51741","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27151","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-31227","title":"Denial-of-service due to malformed ACL selectors in Redis","description":"Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem exists in Redis 7 prior to versions 7.2.6 and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-10-07T19:51:04.52Z","modified":"2024-10-07T20:20:56.702Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:34:14.308905Z"}],"euvd":[{"id":"EUVD-2024-29123","description":"Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem exists in Redis 7 prior to versions 7.2.6 and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-10-07T19:51:04Z","modified":"2024-10-07T20:20:56Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T00:27:46.330731Z"}],"nvd":[{"id":"CVE-2024-31227","description":"Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem exists in Redis 7 prior to versions 7.2.6 and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-10-07T20:15:05.05Z","modified":"2026-06-17T07:28:01.18Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:10:31.271525Z"}],"osv":[{"id":"ALPINE-CVE-2024-31227","description":"Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem exists in Redis 7 prior to versions 7.2.6 and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-10-07T20:15:05.05Z","modified":"2026-11-02T11:17:50.089422508Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"BELL-CVE-2024-31227","status":"published","published":"2024-10-08T08:22:00.7521Z","modified":"2026-01-26T09:36:28.497936Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:19.66992Z"},{"id":"CVE-2024-31227","title":"Denial-of-service due to malformed ACL selectors in Redis","description":"Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem exists in Redis 7 prior to versions 7.2.6 and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-10-07T19:51:04.52Z","modified":"2026-10-28T10:43:41.577455184Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:44:40.06138Z"},{"id":"DEBIAN-CVE-2024-31227","description":"Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem exists in Redis 7 prior to versions 7.2.6 and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-10-07T20:15:05.05Z","modified":"2026-11-02T12:01:51.80409407Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:42.530184Z"},{"id":"RHSA-2024:10869","title":"Red Hat Security Advisory: redis:7 security update","status":"published","published":"2024-12-07T10:02:52Z","modified":"2026-08-07T10:12:50Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"UBUNTU-CVE-2024-31227","description":"Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem exists in Redis 7 prior to versions 7.2.6 and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-10-07T20:15:00Z","modified":"2026-10-06T23:30:56.231501113Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:48.333535Z"},{"id":"ALSA-2024:10869","title":"Moderate: redis:7 security update","description":"Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.  \n\nSecurity Fix(es):  \n\n  * redis: Redis SORT_RO may bypass ACL configuration (CVE-2023-41053)\n  * redis: possible bypass of Unix socket permissions on startup (CVE-2023-45145)\n  * redis: Denial-of-service due to malformed ACL selectors in Redis (CVE-2024-31227)\n  * redis: Lua library commands may lead to stack overflow and RCE in Redis (CVE-2024-31449)\n  * redis: Denial-of-service due to unbounded pattern matching in Redis (CVE-2024-31228)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2024-12-05T00:00:00Z","modified":"2026-10-29T11:30:52.000498318Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"AZL-52008","title":"CVE-2024-31227 affecting package valkey for versions less than 8.0.1-1","description":"Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem exists in Redis 7 prior to versions 7.2.6 and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-10-07T20:15:05Z","modified":"2026-04-21T04:49:41.197495Z","updated_at":"2026-11-02T15:28:06.3228Z"},{"id":"BIT-keydb-2024-31227","title":"Denial-of-service due to malformed ACL selectors in Redis","description":"Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem exists in Redis 7 prior to versions 7.2.6 and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-10-09T16:30:52.029Z","modified":"2026-09-08T08:48:06.91653906Z","updated_at":"2026-11-02T15:28:32.162822Z"},{"id":"BIT-redis-2024-31227","title":"Denial-of-service due to malformed ACL selectors in Redis","description":"Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem exists in Redis 7 prior to versions 7.2.6 and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-10-09T16:41:26.63Z","modified":"2026-09-08T08:48:18.984611582Z","updated_at":"2026-11-02T15:28:35.111822Z"},{"id":"BIT-valkey-2024-31227","title":"Denial-of-service due to malformed ACL selectors in Redis","description":"Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem exists in Redis 7 prior to versions 7.2.6 and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-10-09T16:44:53.016Z","modified":"2026-09-08T08:48:21.190766488Z","updated_at":"2026-11-02T15:28:36.104787Z"},{"id":"MGASA-2024-0340","title":"Updated redis packages fix security vulnerabilities","description":"An authenticated with sufficient privileges may create a malformed ACL\nselector which, when accessed, triggers a server panic and subsequent\ndenial of service. (CVE-2024-31227)\nAuthenticated users can trigger a denial-of-service by using specially\ncrafted, long string match patterns on supported commands such as\n`KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION LIST`, `COMMAND LIST` and ACL\ndefinitions. Matching of extremely long patterns may result in unbounded\nrecursion, leading to stack overflow and process crash. (CVE-2024-31228)\nAn authenticated user may use a specially crafted Lua script to trigger\na stack buffer overflow in the bit library, which may potentially lead\nto remote code execution. (CVE-2024-31449)\n","status":"published","published":"2024-10-27T02:37:06Z","modified":"2026-04-16T04:41:13.875213191Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:14412-1","title":"valkey-8.0.1-1.1 on GA media","description":"These are all security issues fixed in the valkey-8.0.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-10-18T00:00:00Z","modified":"2026-02-04T03:54:17.813413Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2025:15293-1","title":"redis-8.0.2-1.1 on GA media","description":"These are all security issues fixed in the redis-8.0.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:36.205134Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"SUSE-SU-2024:3535-1","title":"Security update for redis","description":"This update for redis fixes the following issues:\n\n- CVE-2024-31227: Fixed parsing issue leading to denail of service (bsc#1231266)\n- CVE-2024-31228: Fixed unbounded recursive pattern matching (bsc#1231265)\n- CVE-2024-31449: Fixed integer overflow bug in Lua bit_tohex (bsc#1231264)\n","status":"published","published":"2024-10-07T08:53:16Z","modified":"2026-02-04T04:20:35.541693Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3537-1","title":"Security update for redis7","description":"This update for redis7 fixes the following issues:\n\n- CVE-2024-31227: Fixed parsing issue leading to denail of service (bsc#1231266)\n- CVE-2024-31228: Fixed unbounded recursive pattern matching (bsc#1231265)\n- CVE-2024-31449: Fixed integer overflow bug in Lua bit_tohex (bsc#1231264)\n","status":"published","published":"2024-10-07T12:16:17Z","modified":"2026-02-04T03:47:33.83673Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3549-1","title":"Security update for redis7","description":"This update for redis7 fixes the following issues:\n\n- CVE-2024-31227: Fixed parsing issue leading to denail of service (bsc#1231266)\n- CVE-2024-31228: Fixed unbounded recursive pattern matching (bsc#1231265)\n- CVE-2024-31449: Fixed integer overflow bug in Lua bit_tohex (bsc#1231264)\n","status":"published","published":"2024-10-08T14:07:20Z","modified":"2026-02-04T04:13:01.560863Z","updated_at":"2026-11-02T15:53:55.639015Z"}]}}