Redis CVEs
19 vulnerabilities mapped to Redis’s software or packages, 1 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-81934 Redis TLS pending-data list use-after-free
CVSS 7.1 highEPSS 0.48%
CVSS 7.5 highEPSS 0.87%
CVE-2026-25243 redis-server RESTORE invalid memory access may allow remote code execution
CVSS 8.8 highEPSS 4.0%
CVE-2026-23631 redis-server Lua use-after-free may allow remote code execution
CVSS 8.8 highEPSS 3.1%
CVE-2025-62507 Redis: Bug in XACKDEL may lead to stack overflow and potential RCE
CVSS 8.8 highEPSS 7.5%
CVE-2025-49844 Redis Lua Use-After-Free may lead to remote code execution
CVSS 10.0 criticalEPSS 82.6%2 incidents
CVE-2025-46819 Redis is vulnerable to DoS via specially crafted LUA scripts
CVSS 6.3 mediumEPSS 1.1%
CVE-2025-46818 Redis: Authenticated users can execute LUA scripts as a different user
CVSS 6.0 mediumEPSS 0.74%
CVE-2025-46817 Lua library commands may lead to integer overflow and potential RCE
CVSS 7.0 highEPSS 3.9%
CVSS 3.5 lowEPSS 0.32%
CVE-2025-48367 Redis DoS Vulnerability due to bad connection error handling
CVSS 7.5 highEPSS 1.2%
CVE-2025-32023 Redis allows out of bounds writes in hyperloglog commands leading to RCE
CVSS 7.0 highEPSS 6.5%
CVE-2025-27151 redis-check-aof may lead to stack overflow and potential RCE
CVSS 4.7 mediumEPSS 1.1%
CVE-2024-51741 Redis allows denial-of-service due to malformed ACL selectors
CVSS 4.4 mediumEPSS 0.30%
CVE-2024-46981 Redis' Lua library commands may lead to remote code execution
CVSS 7.0 highEPSS 8.2%
CVE-2022-0543 Debian-specific Redis Server Lua Sandbox Escape Vulnerability
CVSS 10.0 criticalKEV added EPSS 99.4%
All vendors’ CVEs · JSON · Markdown
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)