Log in Start free

Vulnerability · Published Apr 18, 2023 · Assigned by GitHub_M

CVE-2023-28856`HINCRBYFLOAT` can be used to crash a redis-server process

Medium 5.5

In plain English

A medium-severity improper input validation in redis from redis. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)1.3%top 30.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Redis is an open source, in-memory database that persists on disk. Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that will crash Redis on access in affected versions. This issue has been addressed in in versions 7.0.11, 6.2.12, and 6.0.19. Users are advised to upgrade. There are no known workarounds for this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8redis6.2.17-1.module_el8.10.0+3946+3de613d5ALSA-2025:0595
AlmaLinux:8redis-devel6.2.17-1.module_el8.10.0+3946+3de613d5ALSA-2025:0595
AlmaLinux:8redis-doc6.2.17-1.module_el8.10.0+3946+3de613d5ALSA-2025:0595
Debian:12redis5:7.0.11-1DEBIAN-CVE-2023-28856
Debian:13redis5:7.0.11-1DEBIAN-CVE-2023-28856
Debian:14redis5:7.0.11-1DEBIAN-CVE-2023-28856
Rocky Linux:8redis0:6.2.17-1.module+el8.10.0+1923+5b85c6a7RLSA-2025:0595

Affected products (as reported)

VendorProductVersions
redis redis >= 7.0.0, < 7.0.11>= 6.2.0, < 6.2.12< 6.0.19

Weakness: CWE-617, CWE-20 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References