Skip to content
CVE PROGRAM SOURCE RECORD5.5 Medium

CVE-2024-25116

Specially crafted CF.RESERVE command can lead to denial-of-service

Description

RedisBloom adds a set of probabilistic data structures to Redis. Starting in version 2.0.0 and prior to version 2.4.7 and 2.6.10, authenticated users can use the `CF.RESERVE` command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in RedisBloom 2.4.7 and 2.6.10.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

RedisBloom RedisBloom

  • >= 2.0.0, < 2.4.7affected
  • >= 2.5.0, < 2.6.10affected

References