CVE-2023-22458

Deeper analysis

Redis is an in-memory database that persists on disk. The vulnerability is an integer overflow (CWE-190) that allows an authenticated user to supply specially crafted arguments to the HRANDFIELD or ZRANDMEMBER commands, triggering an assertion failure that crashes the server. It affects Redis versions 6.2.0 up to but not including 6.2.9 and versions 7.0.0 up to but not including 7.0.8.

An attacker with a valid low-privileged local account on the Redis host can execute these commands to cause a denial of service that renders the database unavailable. The CVSS 5.5 vector reflects local access, low attack complexity, and high impact on availability with no effect on confidentiality or integrity.

The official Redis advisories and release notes for versions 6.2.9 and 7.0.8 state that users should upgrade immediately; the commits that correct the integer handling are included in those releases, and no workarounds are documented.

The EPSS score rose from a low baseline to a peak of 0.6777 (current value 0.5124), indicating that exploitation interest increased after disclosure and that the issue merits renewed attention.