CVE-2024-51741: redis Improper Input Validation
CVSS: 4.4v3.1MediumAnalyzed
AliasesALPINE-CVE-2024-51741UBUNTU-CVE-2024-51741DEBIAN-CVE-2024-51741CGA-2432-p98m-wf32CGA-2h3w-7wxj-rjhrCGA-3fx8-f6c8-hch2CGA-48gv-mq33-q63mCGA-49rv-qfvg-h438CGA-5pcr-jv75-mv8xCGA-fx2p-52xp-3fcqCGA-g3f2-mg34-rq6pCGA-hm7f-9m99-4qfjCGA-j639-p8jq-7gj4CGA-m6gq-qhjh-c649CGA-mmc3-hwr7-cm63CGA-p376-gpvm-247qCGA-pchm-vq9p-fg95CGA-q6pc-gfx7-285vCGA-qx44-vvw8-68f6CGA-r69v-q9r5-564mCGA-r6ww-9mc5-48jcCGA-r8xf-wwr3-hx3vCGA-wcv2-7vjv-x4h4CGA-wh9p-f3xh-fm5cCGA-wj2c-mjh6-mf4mCGA-xm37-p5g7-6r6wCGA-xmqh-w4rh-xvvx
Published 06-01-2025Last modified 06-01-2025
Vulnerability summary
CVE-2024-51741 is a medium (CVSS 4.4) Improper Input Validation vulnerability in redis. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.6% of scored vulnerabilities.
CVSS score
4.4/10
010
Medium · v3.1 (CVE.org)EPSS score
0.30%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 10 · Related 10Timeline
- 06-01-2025PublishedVulnerability first disclosed.
- 06-01-2025Last modifiedVulnerability information updated.
Description
Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem is fixed in Redis 7.2.7 and 7.4.2.
CVSS metrics
6 scores · 6 sources · 1 versionMedium 4.4Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HSourcesAll 6 agree
- OSV · AlpineEcosystem advisory · calculated4.4MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated4.4MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated4.4MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated4.4MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
- NVDNIST4.4MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.30%
Chance of exploitation in the next 30 days
Percentile
22%
Versus all other CVEs
30-day change
0.00 pp
From 0.30% on 19-09-2026
19-09-202619-10-2026
EPSS score0.30%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard12 products
- py3-redisAll versions (No fix recorded)
- py3.10-redisAll versions (No fix recorded)
- py3.11-redisAll versions (No fix recorded)
- py3.12-redisAll versions (No fix recorded)
- py3.13-redisAll versions (No fix recorded)
Debian3 products
- redict< 7.3.2+ds-1
- redis< 5:7.0.15-1~deb12u3 | < 5:7.0.15-3
- valkey< 8.0.2+dfsg1-1
Ubuntu3 products
- redictAll versions (No fix recorded)
- redis< 5:7.0.15-1ubuntu0.24.04.1
- valkey< 7.2.8+dfsg1-0ubuntu0.24.04.2
Alpine2 products
- redis≥ 7.0.0, < 7.0.15-r2 | ≥ 7.0.0, < 7.2.7-r0
- valkey< 7.2.8-r0
Redis1 product
- redis≥ 7.0.0, < 7.2.7 | ≥ 7.4.0, < 7.4.2
5 vendors · 21 products
References
12 links- github.com/redis/redis/security/advisories/GHSA-prpq-rh5h-46g9X Refsource CONFIRMREPORTAdvisoryVendor Advisory
