AIKIDO-2026-675182
redisearch.redisearch is vulnerable to Heap-based Buffer Overflow
70
High Risk
This Affects:
redisearch.redisearchTL;DR
RediSearch parses the LIMIT offset and number arguments of FT.SEARCH and FT.AGGREGATE, and the K value of KNN queries in FT.SEARCH, without bounding the user-supplied numbers. A crafted large value causes an integer overflow while sizing the result buffer, producing an undersized heap allocation that is then written past its bounds. The out-of-bounds heap write corrupts memory and can lead to remote code execution in the Redis process. The fix sanitizes and bounds these numeric arguments before allocation.
Who does this affect?
You are affected if you run an affected RediSearch version and let untrusted or externally-influenced Redis clients issue search commands.
Background info
redisearch.redisearch is vulnerable to Heap-based Buffer Overflow in versions 2.0.0 - 2.6.23, 2.8.0 - 2.8.20 and 2.10.0 - 2.10.9.
How to fix this
Upgrade the redisearch/redisearch library to the patch version.
Links
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant