Redis
78 CVEs tracked. 1 of them are in CISA KEV.
This hub aggregates every CVE we track for Redis, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Redis CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 3 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 2 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 1 |
| 2025-05 | 1 |
| 2025-06 | 0 |
| 2025-07 | 3 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 4 |
| 2025-11 | 1 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 3 |
| 2026-06 | 0 |
| 2026-07 | 1 |
| 2026-08 | 1 |
| 2026-09 | 0 |
Severity
How the 78 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical7
- High40
- Medium23
- Low8
Latest CVEs
The 15 most recently published vulnerabilities affecting Redis.
- CVE-2026-81934Redis TLS pending-data list use-after-free7.1
- CVE-2026-66373Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by ...7.5
- CVE-2026-25243redis-server RESTORE invalid memory access may allow remote code execution8.8
- CVE-2026-23631redis-server Lua use-after-free may allow remote code execution8.1
- CVE-2026-23479redis-server use-after-free in unblock client flow may allow remote code execution8.8
- CVE-2025-62507Redis: Bug in XACKDEL may lead to stack overflow and potential RCE8.8
- CVE-2025-49844Redis Lua Use-After-Free may lead to remote code execution9.9
- CVE-2025-46819Redis is vulnerable to DoS via specially crafted LUA scripts6.3
- CVE-2025-46818Redis: Authenticated users can execute LUA scripts as a different user6.0
- CVE-2025-46817Lua library commands may lead to integer overflow and potential RCE7.0
- CVE-2025-46686Redis through 8.0.3 allows memory consumption via a multi-bulk command composed of many bulks, sent by an authenticated user. This occurs because the server allocates memory for the command argumen...3.5
- CVE-2025-48367Redis DoS Vulnerability due to bad connection error handling7.5
- CVE-2025-32023Redis allows out of bounds writes in hyperloglog commands leading to RCE7.0
- CVE-2025-27151redis-check-aof may lead to stack overflow and potential RCE4.7
- CVE-2025-21605Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client7.5
Product grouping is registry-driven, with AI assist and human review. How it works