Vulnerability · Published Apr 9, 2024 · Assigned by GitHub_M
CVE-2024-25115RedisBloom heap buffer overflow in CF.LOADCHUNK command
High 7.0
In plain English
A high-severity heap buffer overflow in RedisBloom from RedisBloom. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).
Severity (CVSS 3.1)7.0High
Exploit odds (30 days)0.4%top 63.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
RedisBloom adds a set of probabilistic data structures to Redis. Starting in version 2.0.0 and prior to version 2.4.7 and 2.6.10, specially crafted `CF.LOADCHUNK` commands may be used by authenticated users to perform heap overflow, which may lead to remote code execution. The problem is fixed in RedisBloom 2.4.7 and 2.6.10.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| RedisBloom | RedisBloom | >= 2.0.0, < 2.4.7>= 2.5.0, < 2.6.10 |
Weakness: CWE-122, CWE-120 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H