Skip to content
CVE PROGRAM SOURCE RECORD7.0 High

CVE-2024-25115

RedisBloom heap buffer overflow in CF.LOADCHUNK command

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

RedisBloom adds a set of probabilistic data structures to Redis. Starting in version 2.0.0 and prior to version 2.4.7 and 2.6.10, specially crafted `CF.LOADCHUNK` commands may be used by authenticated users to perform heap overflow, which may lead to remote code execution. The problem is fixed in RedisBloom 2.4.7 and 2.6.10.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

RedisBloom RedisBloom

  • >= 2.0.0, < 2.4.7affected
  • >= 2.5.0, < 2.6.10affected

References