CVE-2023-22458: redis Integer Overflow or Wraparound
Vulnerability summary
CVE-2023-22458 is a medium (CVSS 5.5) Integer Overflow or Wraparound vulnerability in redis. EPSS estimates a 71.98% chance of exploitation in the next 30 days, higher than 99.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 3 · Related 2Timeline
- 20-01-2023PublishedVulnerability first disclosed.
- 10-03-2025Last modifiedVulnerability information updated.
Description
Redis is an in-memory database that persists on disk. Authenticated users can issue a `HRANDFIELD` or `ZRANDMEMBER` command with specially crafted arguments to trigger a denial-of-service by crashing Redis with an assertion failure. This problem affects Redis versions 6.2 or newer up to but not including 6.2.9 as well as versions 7.0 up to but not including 7.0.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · AlpineEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- NVDNIST5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
71.98%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 71.98% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- redis≥ 6.2.0, < 6.2.9-r0 | ≥ 6.2.0, < 7.0.8-r0
Debian1 product
- redis< 5:7.0.8-1
Redis1 product
- redis≥ 6.2, < 6.2.9 | ≥ 7.0, < 7.0.8 | ≥ 6.2.0, < 6.2.9 | ≥ 7.0.0, < 7.0.8
3 vendors · 3 products
References
7 links- github.com/redis/redis/security/advisories/GHSA-r8w2-2m53-gprjX Refsource CONFIRMThird Party Advisory
- github.com/redis/redis/commit/16f408b1a0121cacd44cbf8aee275d69dc627f02X Refsource MISCPatchThird Party Advisory
