CVE-2023-36824

A heap overflow vulnerability was found in Redis, where extracting key names from a command and a list of arguments may, in some cases, trigger a heap overflow and result in reading random heap memory, heap corruption, and potentially remote code execution. This flaw allows an attacker to trick authenticated users into executing a specially crafted COMMAND GETKEYS or COMMAND GETKEYSANDFLAGS and also trick authenticated users who were set with ACL rules that match key names, to execute a specially crafted command that refers to a variadic list of key names.

The CVE only affects Redis 7.0 or newer versions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.