CVE catalog

CVE-2024-31449

Redis, Lua vulnerabilities

Severity: High · CVSS 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: Oct 3, 2024, 10:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 4.46% · Oct 27, 2026

Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	redis	sid	`5:8.0.6-3`	fixed
Debian	redis	forky	`5:8.0.6-3`	fixed
Debian	redis	trixie	`5:8.0.2-3+deb13u2`	fixed
Debian	redis	trixie-security	`5:8.0.2-3+deb13u3`	fixed
Debian	redis	bookworm	`5:7.0.15-1~deb12u7`	fixed
Debian	redis	bookworm-security	`5:7.0.15-1~deb12u10`	fixed
Ubuntu	redis	noble	`5:7.0.15-1ubuntu0.24.04.4`	fixed
Ubuntu	redis-sentinel	noble	`5:7.0.15-1ubuntu0.24.04.4`	fixed
Ubuntu	redis-server	noble	`5:7.0.15-1ubuntu0.24.04.4`	fixed
Ubuntu	redis-tools	noble	`5:7.0.15-1ubuntu0.24.04.4`	fixed
Alpine	redis	3.15	`6.2.18-r0`	fixed
Alpine	redis	3.17	`7.0.15-r1`	fixed
Alpine	redis	3.18	`7.0.15-r1`	fixed
Alpine	redis	3.19	`7.2.4-r1`	fixed
Alpine	valkey	3.20	`7.2.7-r0`	fixed
Alpine	valkey	3.21	`7.2.7-r0`	fixed
Alpine	valkey	3.22	`7.2.7-r0`	fixed
Alpine	valkey	3.23	`7.2.7-r0`	fixed
Alpine	valkey	3.24	`7.2.7-r0`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	redis	source	sid	`5:7.0.15-2`	not yet assigned	Not reported	[1084805]
Debian	redis	source	forky	`5:7.0.15-2`	not yet assigned	Not reported	[1084805]
Debian	redis	source	trixie	`5:7.0.15-2`	not yet assigned	Not reported	[1084805]
Debian	redis	source	bookworm	`5:7.0.15-1~deb12u2`	not yet assigned	Not reported	[1084805]
Ubuntu	redis	deb	noble	`5:7.0.15-1ubuntu0.24.04.4`	Not reported	Not reported	Not reported
Ubuntu	redis-sentinel	deb	noble	`5:7.0.15-1ubuntu0.24.04.4`	Not reported	Not reported	Not reported
Ubuntu	redis-server	deb	noble	`5:7.0.15-1ubuntu0.24.04.4`	Not reported	Not reported	Not reported
Ubuntu	redis-tools	deb	noble	`5:7.0.15-1ubuntu0.24.04.4`	Not reported	Not reported	Not reported
Alpine	redis	apk	3.15	`6.2.18-r0`	Not reported	ALPINE-CVE-2024-31449	Not reported
Alpine	redis	apk	3.17	`7.0.15-r1`	Not reported	ALPINE-CVE-2024-31449	Not reported
Alpine	redis	apk	3.18	`7.0.15-r1`	Not reported	ALPINE-CVE-2024-31449	Not reported
Alpine	redis	apk	3.19	`7.2.4-r1`	Not reported	ALPINE-CVE-2024-31449	Not reported
Alpine	valkey	apk	3.20	`7.2.7-r0`	Not reported	ALPINE-CVE-2024-31449	Not reported
Alpine	valkey	apk	3.21	`7.2.7-r0`	Not reported	ALPINE-CVE-2024-31449	Not reported
Alpine	valkey	apk	3.22	`7.2.7-r0`	Not reported	ALPINE-CVE-2024-31449	Not reported
Alpine	valkey	apk	3.23	`7.2.7-r0`	Not reported	ALPINE-CVE-2024-31449	Not reported
Alpine	valkey	apk	3.24	`7.2.7-r0`	Not reported	ALPINE-CVE-2024-31449	Not reported

[Debian bug #1084805]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[redis]Fixed
Details (4)
- 5:7.0.15-1~deb12u7 · all · bookworm
  Fixed · Fixed: 5:7.0.15-1~deb12u2
  usn · redis · debian · bookworm; usn · redis · debian · 12
- 5:7.0.15-1~deb12u7 · all · bookworm
  Fixed · Fixed: 5:7.0.15-1~deb12u2
  usn · redis · debian · bookworm; usn · redis · debian · 12
- 5:7.0.15-1~deb12u9 · all · bookworm-security
  Fixed · Fixed: 5:7.0.15-1~deb12u2
  usn · redis · debian · bookworm; usn · redis · debian · 12
- 5:7.0.15-1~deb12u9 · all · bookworm-security
  Fixed · Fixed: 5:7.0.15-1~deb12u2
  usn · redis · debian · bookworm; usn · redis · debian · 12
[redis-sentinel]Fixed
Source package: [redis]
Details (4)
- 5:7.0.15-1~deb12u7 · amd64 · bookworm
  Fixed · Fixed: 5:7.0.15-1~deb12u2
  usn · redis · debian · bookworm; usn · redis · debian · 12
- 5:7.0.15-1~deb12u7 · arm64 · bookworm
  Fixed · Fixed: 5:7.0.15-1~deb12u2
  usn · redis · debian · bookworm; usn · redis · debian · 12
- 5:7.0.15-1~deb12u9 · amd64 · bookworm-security
  Fixed · Fixed: 5:7.0.15-1~deb12u2
  usn · redis · debian · bookworm; usn · redis · debian · 12
- 5:7.0.15-1~deb12u9 · arm64 · bookworm-security
  Fixed · Fixed: 5:7.0.15-1~deb12u2
  usn · redis · debian · bookworm; usn · redis · debian · 12
[redis-server]Fixed
Source package: [redis]
Details (4)
- 5:7.0.15-1~deb12u7 · amd64 · bookworm
  Fixed · Fixed: 5:7.0.15-1~deb12u2
  usn · redis · debian · bookworm; usn · redis · debian · 12
- 5:7.0.15-1~deb12u7 · arm64 · bookworm
  Fixed · Fixed: 5:7.0.15-1~deb12u2
  usn · redis · debian · bookworm; usn · redis · debian · 12
- 5:7.0.15-1~deb12u9 · amd64 · bookworm-security
  Fixed · Fixed: 5:7.0.15-1~deb12u2
  usn · redis · debian · bookworm; usn · redis · debian · 12
- 5:7.0.15-1~deb12u9 · arm64 · bookworm-security
  Fixed · Fixed: 5:7.0.15-1~deb12u2
  usn · redis · debian · bookworm; usn · redis · debian · 12
[redis-tools]Fixed
Source package: [redis]
Details (4)
- 5:7.0.15-1~deb12u7 · amd64 · bookworm
  Fixed · Fixed: 5:7.0.15-1~deb12u2
  usn · redis · debian · bookworm; usn · redis · debian · 12
- 5:7.0.15-1~deb12u7 · arm64 · bookworm
  Fixed · Fixed: 5:7.0.15-1~deb12u2
  usn · redis · debian · bookworm; usn · redis · debian · 12
- 5:7.0.15-1~deb12u9 · amd64 · bookworm-security
  Fixed · Fixed: 5:7.0.15-1~deb12u2
  usn · redis · debian · bookworm; usn · redis · debian · 12
- 5:7.0.15-1~deb12u9 · arm64 · bookworm-security
  Fixed · Fixed: 5:7.0.15-1~deb12u2
  usn · redis · debian · bookworm; usn · redis · debian · 12

[Debian 13 (Trixie)]

[redis]Fixed
Details (5)
- 5:8.0.2-3+deb13u2 · all · trixie
  Fixed · Fixed: 5:7.0.15-2
  usn · redis · debian · 13
- 5:8.0.2-3+deb13u2 · all · trixie
  Fixed · Fixed: 5:7.0.15-2
  usn · redis · debian · 13
- 5:8.0.2-3+deb13u2 · all · trixie-security · Historical version
  Fixed · Fixed: 5:7.0.15-2
  usn · redis · debian · 13
- 5:8.0.2-3+deb13u2 · all · trixie-security
  Fixed · Fixed: 5:7.0.15-2
  usn · redis · debian · 13
- 5:8.0.2-3+deb13u3 · all · trixie-security
  Fixed · Fixed: 5:7.0.15-2
  usn · redis · debian · 13
[redis-sentinel]Fixed
Source package: [redis]
Details (5)
- 5:8.0.2-3+deb13u2 · amd64 · trixie
  Fixed · Fixed: 5:7.0.15-2
  usn · redis · debian · 13
- 5:8.0.2-3+deb13u2 · arm64 · trixie
  Fixed · Fixed: 5:7.0.15-2
  usn · redis · debian · 13
- 5:8.0.2-3+deb13u2 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 5:7.0.15-2
  usn · redis · debian · 13
- 5:8.0.2-3+deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 5:7.0.15-2
  usn · redis · debian · 13
- 5:8.0.2-3+deb13u3 · amd64 · trixie-security
  Fixed · Fixed: 5:7.0.15-2
  usn · redis · debian · 13
[redis-server]Fixed
Source package: [redis]
Details (5)
- 5:8.0.2-3+deb13u2 · amd64 · trixie
  Fixed · Fixed: 5:7.0.15-2
  usn · redis · debian · 13
- 5:8.0.2-3+deb13u2 · arm64 · trixie
  Fixed · Fixed: 5:7.0.15-2
  usn · redis · debian · 13
- 5:8.0.2-3+deb13u2 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 5:7.0.15-2
  usn · redis · debian · 13
- 5:8.0.2-3+deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 5:7.0.15-2
  usn · redis · debian · 13
- 5:8.0.2-3+deb13u3 · amd64 · trixie-security
  Fixed · Fixed: 5:7.0.15-2
  usn · redis · debian · 13
[redis-tools]Fixed
Source package: [redis]
Details (5)
- 5:8.0.2-3+deb13u2 · amd64 · trixie
  Fixed · Fixed: 5:7.0.15-2
  usn · redis · debian · 13
- 5:8.0.2-3+deb13u2 · arm64 · trixie
  Fixed · Fixed: 5:7.0.15-2
  usn · redis · debian · 13
- 5:8.0.2-3+deb13u2 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 5:7.0.15-2
  usn · redis · debian · 13
- 5:8.0.2-3+deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 5:7.0.15-2
  usn · redis · debian · 13
- 5:8.0.2-3+deb13u3 · amd64 · trixie-security
  Fixed · Fixed: 5:7.0.15-2
  usn · redis · debian · 13
[valkey-sentinel]Fixed
Source package: [valkey]
Details (5)
- 8.1.1+dfsg1-3+deb13u2 · amd64 · trixie
  Fixed · Fixed: 8.0.1+dfsg1-1
  usn · valkey · debian · 13
- 8.1.1+dfsg1-3+deb13u2 · arm64 · trixie
  Fixed · Fixed: 8.0.1+dfsg1-1
  usn · valkey · debian · 13
- 8.1.1+dfsg1-3+deb13u2 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 8.0.1+dfsg1-1
  usn · valkey · debian · 13
- 8.1.1+dfsg1-3+deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 8.0.1+dfsg1-1
  usn · valkey · debian · 13
- 8.1.1+dfsg1-3+deb13u3 · amd64 · trixie-security
  Fixed · Fixed: 8.0.1+dfsg1-1
  usn · valkey · debian · 13
[valkey-server]Fixed
Source package: [valkey]
Details (5)
- 8.1.1+dfsg1-3+deb13u2 · amd64 · trixie
  Fixed · Fixed: 8.0.1+dfsg1-1
  usn · valkey · debian · 13
- 8.1.1+dfsg1-3+deb13u2 · arm64 · trixie
  Fixed · Fixed: 8.0.1+dfsg1-1
  usn · valkey · debian · 13
- 8.1.1+dfsg1-3+deb13u2 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 8.0.1+dfsg1-1
  usn · valkey · debian · 13
- 8.1.1+dfsg1-3+deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 8.0.1+dfsg1-1
  usn · valkey · debian · 13
- 8.1.1+dfsg1-3+deb13u3 · amd64 · trixie-security
  Fixed · Fixed: 8.0.1+dfsg1-1
  usn · valkey · debian · 13
[valkey-tools]Fixed
Source package: [valkey]
Details (5)
- 8.1.1+dfsg1-3+deb13u2 · amd64 · trixie
  Fixed · Fixed: 8.0.1+dfsg1-1
  usn · valkey · debian · 13
- 8.1.1+dfsg1-3+deb13u2 · arm64 · trixie
  Fixed · Fixed: 8.0.1+dfsg1-1
  usn · valkey · debian · 13
- 8.1.1+dfsg1-3+deb13u2 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 8.0.1+dfsg1-1
  usn · valkey · debian · 13
- 8.1.1+dfsg1-3+deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 8.0.1+dfsg1-1
  usn · valkey · debian · 13
- 8.1.1+dfsg1-3+deb13u3 · amd64 · trixie-security
  Fixed · Fixed: 8.0.1+dfsg1-1
  usn · valkey · debian · 13

Observed: Oct 27, 2026, 6:58:48 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]