CVE-2022-24736

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Redis is an in-memory database that persists on disk. Prior to versions 6.2.7 and 7.0.0, an attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result with a crash of the redis-server process. The problem is fixed in Redis versions 7.0.0 and 6.2.7. An additional workaround to mitigate this problem without patching the redis-server executable, if Lua scripting is not being used, is to block access to `SCRIPT LOAD` and `EVAL` commands using ACL rules.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

VendorProductVersions
redisredis< 6.2.7; < 7.0.0

References

Timeline

Published
Apr 27, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-247376.5HTTPie is a command-line HTTP client. HTTPie has the practical concept of sessions, which help users to persistently store some of the stateCVE-2022-247387.4Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. In versions of evmos prior to 2.0.1 attackers are able to drain unclaCVE-2022-247396.1alltube is an html front end for youtube-dl. On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an opCVE-2022-24748.0Authentication is currently unsupported in Haas Controller version 100.20.000.1110 when using the “Ethernet Q Commands” service, which allowCVE-2022-247407.5Volto is a ReactJS-based frontend for the Plone Content Management System. Between versions 14.0.0-alpha.5 and 15.0.0-alpha.0, a user could CVE-2022-247416.5Nextcloud server is an open source, self hosted cloud style services platform. In affected versions an attacker can cause a denial of servicCVE-2022-247425.5Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the data if browser tab CVE-2022-247438.2Sylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set to null after the paCVE-2022-247443.5Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user sessionCVE-2022-247456.5Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions guest sessioCVE-2022-247466.1Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions it is possibCVE-2022-247475.3Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. Affected versions of shopware do
CVE-2022-24736: Medium severity, CVSS 5.5 | Vulnix