[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fsWT01X7PzX1WK5OKNrDhed_FH5Pdx1sa5zlCWGrC7_Y":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":32,"kevVulnerabilities":92,"topProductsByCves":93,"seoMetadata":97,"meta":106},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":31},26779,"redislabs",3,26,0,297,"2023-11-16","r",[16,22,26],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":11,"last_cve_update":21},137104,"redis",186,22,"2021-09-20",{"id":23,"product_name":24,"version_count":25,"cve_count":9,"kev_count":11,"last_cve_update":13},137105,"redisgraph",110,{"id":27,"product_name":28,"version_count":29,"cve_count":29,"kev_count":11,"last_cve_update":30},137103,"hiredis",1,"2020-01-16","Redislabs is a technology vendor with 3 tracked products and 26 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[33,42,50,56,61,65,70,77,81,87],{"cveId":34,"description":35,"publishedDate":36,"cvssScore":37,"cvssVersion":38,"severity":39,"isKev":40,"epssScore":41},"CVE-2018-11218","Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer overflows.","2018-06-17",9.8,"v3.0","Critical",false,0.59006,{"cveId":43,"description":44,"publishedDate":45,"cvssScore":46,"cvssVersion":47,"severity":48,"isKev":40,"epssScore":49},"CVE-2021-32761","Redis is an in-memory database that persists on disk. A vulnerability involving out-of-bounds read and integer overflow to buffer overflow exists starting with version 2.2 and prior to versions 5.0.13, 6.0.15, and 6.2.5. On 32-bit systems, Redis `*BIT*` command are vulnerable to integer overflow that can potentially be exploited to corrupt the heap, leak arbitrary heap contents or trigger remote code execution. The vulnerability involves changing the default `proto-max-bulk-len` configuration parameter to a very large value and constructing specially crafted commands bit commands. This problem only affects Redis on 32-bit platforms, or compiled as a 32-bit binary. Redis versions 5.0.`3m 6.0.15, and 6.2.5 contain patches for this issue. An additional workaround to mitigate the problem without patching the `redis-server` executable is to prevent users from modifying the `proto-max-bulk-len` configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.","2021-07-21",7.5,"v3.1","High",0.37772,{"cveId":51,"description":52,"publishedDate":53,"cvssScore":54,"cvssVersion":47,"severity":48,"isKev":40,"epssScore":55},"CVE-2019-10192","A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By carefully corrupting a hyperloglog using the SETRANGE command, an attacker could trick Redis interpretation of dense HLL encoding to write up to 3 bytes beyond the end of a heap-allocated buffer.","2019-07-11",7.2,0.26048,{"cveId":57,"description":58,"publishedDate":59,"cvssScore":46,"cvssVersion":38,"severity":48,"isKev":40,"epssScore":60},"CVE-2018-12453","Type confusion in the xgroupCommand function in t_stream.c in redis-server in Redis before 5.0 allows remote attackers to cause denial-of-service via an XGROUP command in which the key is not a stream.","2018-06-16",0.23901,{"cveId":62,"description":63,"publishedDate":53,"cvssScore":54,"cvssVersion":47,"severity":48,"isKev":40,"epssScore":64},"CVE-2019-10193","A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By corrupting a hyperloglog using the SETRANGE command, an attacker could cause Redis to perform controlled increments of up to 12 bytes past the end of a stack-allocated buffer.",0.23703,{"cveId":66,"description":67,"publishedDate":68,"cvssScore":37,"cvssVersion":47,"severity":39,"isKev":40,"epssScore":69},"CVE-2016-8339","A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. An out of bounds write vulnerability exists in the handling of the client-output-buffer-limit option during the CONFIG SET command for the Redis data structure store. A crafted CONFIG SET command can lead to an out of bounds write potentially resulting in code execution.","2016-10-28",0.14834,{"cveId":71,"description":72,"publishedDate":73,"cvssScore":74,"cvssVersion":75,"severity":39,"isKev":40,"epssScore":76},"CVE-2015-4335","Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.","2015-06-09",10,"v2",0.09492,{"cveId":78,"description":79,"publishedDate":36,"cvssScore":37,"cvssVersion":38,"severity":39,"isKev":40,"epssScore":80},"CVE-2018-11219","An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2, leading to a failure of bounds checking.",0.06967,{"cveId":82,"description":83,"publishedDate":84,"cvssScore":85,"cvssVersion":47,"severity":48,"isKev":40,"epssScore":86},"CVE-2021-21309","Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and potentially result with remote code execution. Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the limit is significantly increased, receiving a large request from a client may trigger several integer overflow scenarios, which would result with buffer overflow and heap corruption. We believe this could in certain conditions be exploited for remote code execution. By default, authenticated Redis users have access to all configuration parameters and can therefore use the “CONFIG SET proto-max-bulk-len” to change the safe default, making the system vulnerable. **This problem only affects 32-bit Redis (on a 32-bit system, or as a 32-bit executable running on a 64-bit system).** The problem is fixed in version 6.2, and the fix is back ported to 6.0.11 and 5.0.11. Make sure you use one of these versions if you are running 32-bit Redis. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent clients from directly executing `CONFIG SET`: Using Redis 6.0 or newer, ACL configuration can be used to block the command. Using older versions, the `rename-command` configuration directive can be used to rename the command to a random string unknown to users, rendering it inaccessible. Please note that this workaround may have an additional impact on users or operational systems that expect `CONFIG SET` to behave in certain ways.","2021-02-26",8.8,0.0479,{"cveId":88,"description":89,"publishedDate":90,"cvssScore":46,"cvssVersion":47,"severity":48,"isKev":40,"epssScore":91},"CVE-2015-8080","Integer overflow in the getnum function in lua_struct.c in Redis 2.8.x before 2.8.24 and 3.0.x before 3.0.6 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number, which triggers a stack-based buffer overflow.","2016-04-13",0.04576,[],[94,95,96],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":11,"last_cve_update":21},{"id":23,"product_name":24,"version_count":25,"cve_count":9,"kev_count":11,"last_cve_update":13},{"id":27,"product_name":28,"version_count":29,"cve_count":29,"kev_count":11,"last_cve_update":30},{"title":98,"metaDescription":99,"keywords":100,"structuredData":101},"Redislabs - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Redislabs covering 3 products with 26 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Redislabs vulnerabilities, Redislabs security, Redislabs CVE, Redislabs threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":102,"@type":103,"name":104,"description":99,"url":105},"https:\u002F\u002Fschema.org","Organization","Redislabs","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fredislabs",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":107,"apiVersion":108},"2026-10-18T13:14:48.425Z","3.0"]