Heap overflow issue with the Lua cjson library used by Redis
At a glance
Severity
HIGH 7.0
EPSS
EPSS 41.41 % · percentile 99 (2026-10-27)
State
PUBLISHED
Published
Updated
Assigner
GitHub_M
NVD status
Modified
Description
Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. The problem is fixed in versions 7.0.12, 6.2.13, and 6.0.20.
