CVE-2024-25115

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

RedisBloom adds a set of probabilistic data structures to Redis. Starting in version 2.0.0 and prior to version 2.4.7 and 2.6.10, specially crafted `CF.LOADCHUNK` commands may be used by authenticated users to perform heap overflow, which may lead to remote code execution. The problem is fixed in RedisBloom 2.4.7 and 2.6.10.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120 CWE-122

Affected software

No affected versions have been published.

Timeline

Published: Apr 9, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-251165.5RedisBloom adds a set of probabilistic data structures to Redis. Starting in version 2.0.0 and prior to version 2.4.7 and 2.6.10, authentica CVE-2024-251179.8php-svg-lib is a scalable vector graphics (SVG) file parsing/rendering library. Prior to version 0.5.2, php-svg-lib fails to validate that f CVE-2024-251186.5TYPO3 is an open source PHP based web content management system released under the GNU GPL. Password hashes were being reflected in the edit CVE-2024-251194.9TYPO3 is an open source PHP based web content management system released under the GNU GPL. The plaintext value of `$GLOBALS['SYS']['encrypt CVE-2024-251204.3TYPO3 is an open source PHP based web content management system released under the GNU GPL. The TYPO3-specific `t3://` URI scheme could be u CVE-2024-251217.1TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions of TYPO3 entities of the Fi CVE-2024-251226.1sidekiq-unique-jobs is an open source project which prevents simultaneous Sidekiq jobs with the same unique arguments to run. Specially craf CVE-2024-251237.5MSS (Mission Support System) is an open source package designed for planning atmospheric research flights. In file: `index.py`, there is a m CVE-2024-251249.8Fiber is a web framework written in go. Prior to version 2.52.1, the CORS middleware allows for insecure configurations that could potential CVE-2024-251255.3Digdag is an open source tool that to build, run, schedule, and monitor complex pipelines of tasks across various platforms. Treasure Data's CVE-2024-251267.5Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer t CVE-2024-251289.1Flask-AppBuilder is an application development framework, built on top of Flask. When Flask-AppBuilder is set to AUTH_TYPE AUTH_OID, it allo