AIKIDO-2026-243484
redis is vulnerable to Out-of-bounds Write
75
High Risk
This Affects:
redisTL;DR
Affected versions of redis load Count-Min Sketch data from RDB payloads without validating the sketch dimensions. During deserialization the width and depth values are multiplied to size the counter array, and that multiplication can overflow so the allocated buffer is smaller than the data written into it. Loading a crafted RDB payload then triggers a heap out-of-bounds write that can crash the server process or lead to remote code execution. The fix rejects dimensions whose product would overflow before allocating the counter array.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and the server can load Count-Min Sketch RDB data you do not fully control.
Background info
redis is vulnerable to Out-of-bounds Write in versions 8.0.0 - 8.2.8, 8.4.0 - 8.4.5, 8.6.0 - 8.6.5, 8.8.0 - 8.8.1 and 8.10.0 - 8.10.0.
How to fix this
Upgrade the redis library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant