CVE-2024-31228 in Redis
Summary
by MITRE • 10/07/2024
Redis is an open source, in-memory database that persists on disk. Authenticated users can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as `KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION LIST`, `COMMAND LIST` and ACL definitions. Matching of extremely long patterns may result in unbounded recursion, leading to stack overflow and process crash. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2025
Redis serves as a popular in-memory data structure store widely adopted for caching, session management, and real-time data processing applications. The vulnerability identified as CVE-2024-31228 represents a critical denial-of-service flaw that affects authenticated users who can manipulate specific command patterns to trigger system instability. This vulnerability manifests through the processing of specially crafted, excessively long string match patterns within core Redis operations including KEYS, SCAN, PSUBSCRIBE, FUNCTION LIST, COMMAND LIST, and ACL definitions. The technical implementation of these commands relies on pattern matching algorithms that can exhibit unbounded recursion when handling extremely long patterns, ultimately resulting in stack overflow conditions that cause process crashes and complete service disruption.
The underlying flaw stems from insufficient input validation and recursion depth limits within Redis's pattern matching implementations. When authenticated users submit malformed patterns to commands like KEYS or SCAN, the system processes these inputs through recursive pattern matching functions without adequate safeguards against excessively long string sequences. This behavior directly maps to CWE-674, which describes "Uncontrolled Recursion" in software systems, where recursive functions lack proper termination conditions or depth limitations. The vulnerability affects multiple Redis versions including 6.2.x series prior to 6.2.16, 7.2.x series prior to 7.2.6, and 7.4.x series prior to 7.4.1, indicating a widespread impact across the Redis codebase. The attack vector requires authentication since only authenticated users can execute the affected commands, but the impact extends to complete service availability disruption.
The operational impact of this vulnerability extends beyond simple service interruption to encompass potential business continuity risks for organizations relying on Redis for critical operations. When exploited, the vulnerability can cause cascading failures in distributed systems where Redis serves as a foundational component for caching, session storage, or message queuing. The crash conditions affect not just individual Redis instances but can potentially disrupt entire application stacks that depend on Redis availability. This vulnerability aligns with ATT&CK technique T1499.004, which covers "Endpoint Denial of Service" through resource exhaustion attacks. Organizations using Redis in production environments face significant risk of unauthorized users leveraging this vulnerability to cause service degradation or complete outages, particularly in scenarios where Redis is exposed to untrusted network segments or where privilege escalation paths exist.
Mitigation strategies must prioritize immediate patching of affected Redis installations to versions 6.2.16, 7.2.6, or 7.4.1 where the vulnerability has been addressed through enhanced input validation and recursion depth controls. Network segmentation and access control measures should be reinforced to limit authentication exposure, ensuring that only trusted administrative entities can access Redis instances with elevated privileges. Monitoring systems should be configured to detect unusual patterns in command execution, particularly around the affected commands that process pattern matching operations. Organizations should implement rate limiting and resource consumption controls to prevent exploitation attempts from consuming excessive system resources. Security teams must conduct comprehensive vulnerability assessments across all Redis deployments to identify and remediate affected systems, while also establishing incident response procedures for rapid containment and recovery in case of exploitation attempts. The vulnerability highlights the importance of input validation and recursion safety mechanisms in database systems, particularly those handling user-provided pattern matching operations.