Redis string pattern matching can be abused to achieve Denial of Service
redis · redis
Redis, an in-memory database that persists to disk, is vulnerable to a denial-of-service flaw in its string pattern matching, where crafted patterns passed to commands such as SCAN or KEYS can make the server hang and consume 100% CPU. An attacker needs valid authenticated access to the database and the ability to issue these commands, with no user interaction required and no network-adjacent position needed beyond reaching the service.
Redis is an in-memory database that persists on disk. Authenticated users can use string matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. The problem is fixed in Redis versions 6.0.18, 6.2.11, 7.0.9.
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Disclosed on 1 Mar 2023. No public exploit code or confirmed exploitation is recorded.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.