CVE-2019-10192

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By carefully corrupting a hyperloglog using the SETRANGE command, an attacker could trick Redis interpretation of dense HLL encoding to write up to 3 bytes beyond the end of a heap-allocated buffer.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122CWE-787

Affected software

VendorProductVersions
Redis Labsredis3.x before 3.2.13; 4.x before 4.0.14; 5.x before 5.0.4

References

Timeline

Published
Jul 11, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-101937.2A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.CVE-2019-101945.5Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions. were found to be insufficiently protected. PasswordCVE-2019-101956.5A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way thCVE-2019-101969.8A flaw was found in http-proxy-agent, prior to version 2.1.0. It was discovered http-proxy-agent passes an auth option to the Buffer construCVE-2019-101979.1A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters wCVE-2019-101986.5An authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7. Previously, commit tasks were searched through find_reCVE-2019-101998.8It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An attacker could use thCVE-2019-102007.2A flaw was discovered in OpenShift Container Platform 4 where, by default, users with access to create pods also have the ability to schedulCVE-2019-10200017.5yard before 0.9.20 allows path traversal.CVE-2019-10200027.5Pterodactyl before 0.7.14 with 2FA allows credential sniffing.CVE-2019-10200035.4invenio-records before 1.2.2 allows XSS.CVE-2019-10200047.5Tridactyl before 1.16.0 allows fake key events.
CVE-2019-10192: High severity, CVSS 7.2 | Vulnix