Hiredis
Monthly
Denial of service in hiredis post-v1.5.0 (commit 29ea279) occurs when the RESP aggregate parser performs an uncontrolled memory allocation based on an oversized element or length count supplied in a Redis server reply. A hiredis-based client that connects to a malicious or compromised Redis server, or whose unencrypted connection is subject to man-in-the-middle redirection, can be driven into memory exhaustion and crash or unresponsiveness; no authentication on the hiredis side and no user interaction are required. The provided data does not include a CISA KEV entry, and no public exploit identified at time of analysis, so exploitation should be assessed as requiring an attacker-controlled or untrusted Redis endpoint rather than as confirmed active exploitation.
Hiredis is a minimalistic C client library for the Redis database. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
async.c and dict.c in libhiredis.a in hiredis through 0.14.0 allow a NULL pointer dereference because malloc return values are unchecked. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Denial of service in hiredis post-v1.5.0 (commit 29ea279) occurs when the RESP aggregate parser performs an uncontrolled memory allocation based on an oversized element or length count supplied in a Redis server reply. A hiredis-based client that connects to a malicious or compromised Redis server, or whose unencrypted connection is subject to man-in-the-middle redirection, can be driven into memory exhaustion and crash or unresponsiveness; no authentication on the hiredis side and no user interaction are required. The provided data does not include a CISA KEV entry, and no public exploit identified at time of analysis, so exploitation should be assessed as requiring an attacker-controlled or untrusted Redis endpoint rather than as confirmed active exploitation.
Hiredis is a minimalistic C client library for the Redis database. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
async.c and dict.c in libhiredis.a in hiredis through 0.14.0 allow a NULL pointer dereference because malloc return values are unchecked. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.