Dashboard / CVE-2024-31449

CVE-2024-31449

HIGH 1 PoC
MEDIUM Priority: 0.31 BB Relevance: 40/100
Published: 2024-10-07 Modified: 2026-11-03 First seen: 2026-11-03 Status: active

Attack Surface

No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Local
AC: High
PR: Low
UI: None
S: Unchanged
C: High
I: High
A: High

Description

Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Weakness Classification (2)

Affected Software (10)

VendorProductVersion
redis redis >= 2.6, < 6.2.16
redis redis >= 7.0.0, < 7.2.6
redis redis >= 7.3.0, < 7.4.1
redis redis 2.8.18 – 6.2.16
redis redis 7.4.0
redis redis 7.4.0
redis redis 7.4.0
redis redis >= 2.6, < 6.2.16
redis redis >= 7.0.0, < 7.2.6
redis redis >= 7.3.0, < 7.4.1

References & Advisories (2)

Proof of Concept (1)

—
https://github.com/daeseong1209/CVE-2024-31449
nomi-sec

Bug Bounty Relevance

40 / 100
✓ No user interaction
✓ PoC available (1)

CVSS Score

7.0 / 10.0 v3.1
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploitation Probability

4.46%
Raw Score 0.044580
Percentile 91.6%
Date 2026-11-14

EPSS Trend

2026-11-14
0.04458
2026-11-13
0.04458
2026-11-12
0.04458
2026-11-10
0.04458
2026-11-09
0.04458
2026-11-08
0.04458
2026-11-07
0.04458
2026-11-06
0.04458
2026-11-05
0.04458
2026-11-04
0.04458
2026-11-03
0.04458

Intelligence Sources

mitre ref →
nvd ref →

External Links