Skip to content
Fencer Vulns
high 7.4

CVE-2023-36824 in the critical feed json

Heap overflow in COMMAND GETKEYS and ACL evaluation in Redis

published 2023-07-10 3 y ago modified 2026-09-08 2 mo ago also BIT-keydb-2023-36824 , BIT-redis-2023-36824 , BIT-valkey-2023-36824 , EUVD-2023-40750 , GHSA-4cfx-h9gq-xpx3

cvss
7.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
77.4%
EPSS 77.4% chance of exploitation in 30 days, percentile 99.5%
public exploits
0
none known

Summary

Redis is an in-memory database that persists on disk. In Redit 7.0 prior to 7.0.12, extracting key names from a command and a list of arguments may, in some cases, trigger a heap overflow and result in reading random heap memory, heap corruption and potentially remote code execution. Several scenarios that may lead to authenticated users executing a specially crafted `COMMAND GETKEYS` or `COMMAND GETKEYSANDFLAGS`and authenticated users who were set with ACL rules that match key names, executing a specially crafted command that refers to a variadic list of key names. The vulnerability is patched in Redis 7.0.12.

Patch / fix

  • bitnami keydb 7.0.12
  • bitnami redis 7.0.12
  • bitnami valkey 7.0.12
  • redis redis 7.0.12
  • redis Debian 12 5:7.0.15-1~deb12u1
  • redis Debian 14, Debian 13 5:7.0.12-1

debian advisories DEBIAN-CVE-2023-36824

  • redis7 SLE Module for Server Applications 15 SP5, openSUSE Leap 15.5 7.0.8-150500.3.3.1

suse advisories SUSE-SU-2023:2925-1

  • redis openSUSE Tumbleweed 7.0.12-1.1

opensuse advisories openSUSE-SU-2024:13047-1

  • redis Alpine 3.24, Alpine 3.23, Alpine 3.22 +6 more 7.0.12-r0

alpine advisories ALPINE-CVE-2023-36824

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-36824 updated cvss 8.8

redis: heap overflow in COMMAND GETKEYS and ACL evaluation

  • Red Hat 3scale API Management Platform 2 3scale-amp2/system-rhel7, 3scale-amp2/backend-rhel8
    affected: no fix available
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/search-api-rhel8 Red Hat Ansible Automation Platform 1.2 ansible-tower Red Hat Enterprise Linux 8 redis Red Hat Enterprise Linux 9 redis Red Hat Fuse 7 redis Red Hat OpenStack Platform 16.1 openstack-redis-container, openstack-redis-base-container
    +5 more products
    Red Hat OpenStack Platform 17.0 openstack-redis-container Red Hat OpenStack Platform 17.1 openstack-redis-container Red Hat OpenStack Platform 18.0 openstack-redis-container Red Hat Satellite 6 rubygem-gitlab-sidekiq-fetcher, tfm-rubygem-gitlab-sidekiq-fetcher Red Hat Software Collections rh-redis6-redis
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

77.42% chance of exploitation in the next 30 days, higher than 99.5% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
OSV 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
bitnami keydb
>=7.0.0, <7.0.12
7.0.12
bitnami redis
>=7.0.0, <7.0.12
7.0.12
bitnami valkey
>=7.0.0, <7.0.12
7.0.12

Affected products

  • redis redis

Classification

Weakness
  • CWE-122 Heap-based Buffer Overflow
  • CWE-131 Incorrect Calculation of Buffer Size
  • CWE-787 Out-of-bounds Write
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of redis/redis published their own advisory on GitHub. Reviewed sources take precedence over it.