CVE catalog

CVE-2024-51737

redisearch: CVE-2024-51737

[CVE catalog]

Severity
High · CVSS 7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.39% · Oct 25, 2026

RediSearch is a Redis module that provides querying, secondary indexing, and full-text search for Redis. An authenticated redis user executing FT.SEARCH or FT.AGGREGATE with a specially crafted LIMIT command argument, or FT.SEARCH with a specially crafted KNN command argument, can trigger an integer overflow, leading to heap overflow and potential remote code execution. This vulnerability is fixed in 2.6.24, 2.8.21, and 2.10.10. Avoid setting value of -1 or large values for configuration parameters MAXSEARCHRESULTS and MAXAGGREGATERESULTS, to avoid exploiting large LIMIT arguments.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianredisearchsid1:1.2.2-4not affected
Debianredisearchbookworm1:1.2.2-4not affected
Ubunturedisearch18.040.90.0~alpha1-1vulnerable
Ubunturedisearch18.040.90.1-1vulnerable
Ubunturedisearch18.040.99.0-1vulnerable
Ubunturedisearch18.040.99.2-1vulnerable
Ubunturedisearch18.041.0.0-1vulnerable
Ubunturedisearch18.041.0.1-1vulnerable
Ubunturedisearch18.041.0.2-1vulnerable
Ubunturedisearch18.041.0.5-1vulnerable
Ubunturedisearch18.041.0.6-1vulnerable
Ubunturedisearch18.041.0.7-1vulnerable
Ubunturedisearch18.041.0.8-1vulnerable
Ubunturedisearch20.041:1.2.1-4vulnerable
Ubunturedisearch22.041:1.2.2-4vulnerable
Ubunturedisearch24.041:1.2.2-4vulnerable
Ubunturedisearch25.101:1.2.2-4vulnerable
Ubunturedisearch26.041:1.2.2-4vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
DebianredisearchsourcesidNot affectedunimportantNot reportedNot reported
DebianredisearchsourcebookwormNot affectedunimportantNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [redis-redisearch]Not affected

    Source package: [redisearch]

    Details (2)

    • 1:1.2.2-4 · amd64 · bookworm

      Not affected

      dsa · redisearch · debian · bookworm

    • 1:1.2.2-4 · arm64 · bookworm

      Not affected

      dsa · redisearch · debian · bookworm

  • [redis-redisearch-doc]Not affected

    Source package: [redisearch]

    Details (2)

    • 1:1.2.2-4 · all · bookworm

      Not affected

      dsa · redisearch · debian · bookworm

    • 1:1.2.2-4 · all · bookworm

      Not affected

      dsa · redisearch · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]