EUVD-2026-86315
GHSA-h86j-r3fh-gj2j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInduce hiredis client to connect to attacker-controlled Redis server
-
ExploitServer returns crafted RESP aggregate reply with oversized length
-
ExecutionParser performs uncontrolled memory allocation
-
ImpactClient process exhausts memory and crashes (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that a hiredis-based client connect to a malicious or compromised Redis server (or that an attacker MITM an existing client-server connection) so the attacker can return a crafted RESP aggregate reply that declares an oversized element/length count, triggering the uncontrolled allocation in the aggregate parser. The limiting factor is this client-side/server-controlled attack surface: applications that only ever connect to fully trusted, network-isolated Redis instances are not directly exposed, whereas deployments vulnerable to SSRF, connection redirection, hostile/multi-tenant Redis endpoints, or unencrypted-link MITM are at risk. No authentication on the hiredis side is needed (PR:N), and no user interaction is required. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H = 7.5 HIGH) reflects a network-reachable, low-complexity, unauthenticated availability-only impact (DoS), consistent with CWE-770 uncontrolled memory allocation. However, the raw vector understates a key nuance: hiredis is a CLIENT library, so the vulnerable RESP aggregate parser processes replies coming FROM a Redis server - meaning the 'attacker' is effectively a malicious/compromised Redis server or a MITM on the client-server channel, not an arbitrary internet attacker hitting a listening service. That materially narrows real-world exposure to deployments where a hiredis-based client can be induced to connect to an untrusted/attacker-influenced endpoint. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data - exploitation status is therefore 'no public exploit identified at time of analysis.' There is no SSVC decision data supplied. Net: a legitimate widely-relevant DoS bug given hiredis's huge deployment footprint, but not an emergency-patch drop-everything item absent evidence of exploitation, and the client-side attack model should temper prioritization for environments where Redis servers are fully trusted. |
| Exploit ScenarioDerived | An application built on hiredis is made to connect to an attacker-controlled or compromised Redis endpoint (e.g., via SSRF, DNS/network redirection, MITM, or a hostile multi-tenant cache). The malicious server returns a crafted RESP aggregate reply declaring an enormous element/length count, causing hiredis to attempt an uncontrolled up-front memory allocation and crash the client process (OOM / denial of service). No public PoC is identified; only a GitHub issue (#1357) is referenced. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Denial of service in hiredis post-v1.5.0 (commit 29ea279) occurs when the RESP aggregate parser performs an uncontrolled memory allocation based on an oversized element or length count supplied in a Redis server reply. A hiredis-based client that connects to a malicious or compromised Redis server, or whose unencrypted connection is subject to man-in-the-middle redirection, can be driven into memory exhaustion and crash or unresponsiveness; no authentication on the hiredis side and no user interaction are required. The provided data does not include a CISA KEV entry, and no public exploit identified at time of analysis, so exploitation should be assessed as requiring an attacker-controlled or untrusted Redis endpoint rather than as confirmed active exploitation.
RemediationAI
No vendor-released patched version is identified in the provided data; the primary action is to track https://github.com/redis/hiredis/issues/1357 for the upstream fix commit and any tagged hiredis release that contains it, then upgrade or rebuild against that fixed revision. Until an exact fix version is confirmed, reduce exposure by ensuring hiredis clients connect only to trusted, network-isolated Redis endpoints and by disabling or tightly restricting outbound connections to Redis hosts that could be attacker-controlled or influenced through SSRF or connection redirection. Enforce TLS with certificate validation for Redis client-server links to defeat man-in-the-middle tampering, with the caveat that TLS does not protect against a malicious server the client is deliberately configured to trust. Apply OS, container, or cgroup memory limits to bound the impact of uncontrolled allocations; the trade-off is that a triggered allocation can still terminate or stall the client process, but the host is protected from broader memory exhaustion. Monitor the upstream issue and vendor advisories for the authoritative patch version rather than assuming any version is fixed from the provided references.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
hiredis is a C client library for Redis that implements the RESP protocol, including aggregate reply types such as arrays and maps. The vulnerable component parses aggregate length prefixes and allocates memory according to the declared element count; because that count is not bounded or throttled, an attacker controlling the Redis server or intercepting the connection can return an aggregate reply with an oversized count and force the client to allocate an excessive amount of memory. This is CWE-770 (Allocation of Resources Without Limits or Throttling), and the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5 HIGH) reflects network reachability, low complexity, no privileges or user interaction, and availability-only impact. The provided CPE is cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:* with no vendor/product populated, and the EUVD affected-version field is n/a, so the version constraint comes from the description: hiredis commit 29ea279 after v1.5.0. The attack surface is client-side and server-controlled; clients that only reach trusted, network-isolated Redis instances are not directly exposed, while SSRF, connection redirection, hostile or multi-tenant Redis endpoints, and unencrypted-link MITM scenarios are at risk.
Know when Hiredis gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Client parses attacker-controlled server reply over the network with no auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only crash/OOM (A:H, C:N/I:N), agreeing with the 7.5 base.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
hiredis commit 29ea279 (post-v1.5.0) contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser.
Executive ViewAI
Applications and services that embed the hiredis Redis client library at versions after v1.5.0 (including commit 29ea279) can be driven into memory exhaustion and crash when they connect to an attacker-controlled or compromised Redis endpoint, or when an unencrypted connection is redirected by a man-in-the-middle. Because hiredis is a common dependency in internal tooling and customer-facing services, a successful attack could cause availability outages affecting multiple business functions. No vendor-released patch identified at time of analysis and no public exploit identified at time of analysis, so exposure depends on whether the organization connects to untrusted Redis endpoints.
No vendor-released patch identified at time of analysis. Interim mitigations include enforcing TLS (stunnel or native Redis TLS) on all Redis connections to prevent man-in-the-middle redirection, restricting hiredis-based clients to trusted and segmented Redis endpoints only, applying OS-level memory caps (ulimit, cgroups) to limit the impact of memory exhaustion, monitoring for abnormal memory growth or client crashes, and avoiding connections to untrusted or third-party Redis servers.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
async.c and dict.c in libhiredis.a in hiredis through 0.14.0 allow a NULL pointer dereference because malloc return valu
Hiredis is a minimalistic C client library for the Redis database. Rated high severity (CVSS 8.8), this vulnerability is
Exploit-DB