CVE-2024-31228: Redis Database DOS Vulnerability

CVE-2024-31228 Overview

Redis, the widely-deployed open source in-memory database that persists on disk, contains a denial-of-service vulnerability that allows authenticated users to crash the Redis server. By using specially crafted, long string match patterns on supported commands such as KEYS, SCAN, PSUBSCRIBE, FUNCTION LIST, COMMAND LIST, and ACL definitions, attackers can trigger unbounded recursion in the pattern matching logic, leading to stack overflow and process crash.

Critical Impact

Authenticated attackers can cause complete service disruption of Redis instances through crafted pattern matching requests, potentially affecting all applications and services dependent on the Redis database.

Affected Products

• Redis versions prior to 6.2.16
• Redis versions 7.0.x through 7.2.5
• Redis version 7.4.0 (including RC1 and RC2)

Discovery Timeline

• October 7, 2024 - CVE-2024-31228 published to NVD
• November 3, 2025 - Last updated in NVD database

Technical Details for CVE-2024-31228

Vulnerability Analysis

This vulnerability exploits a flaw in Redis's pattern matching implementation used across multiple commands. When processing extremely long string match patterns, the matching algorithm enters an unbounded recursion state. This recursive processing continues until the process stack is exhausted, resulting in a stack overflow condition and subsequent process crash.

The vulnerability affects several core Redis commands that utilize glob-style pattern matching functionality. These include KEYS for listing keys matching a pattern, SCAN for iterating the keyspace, PSUBSCRIBE for subscribing to channels matching patterns, FUNCTION LIST and COMMAND LIST for filtering function and command listings, as well as ACL definitions that use pattern-based access controls.

Since the vulnerability requires authentication, an attacker must first obtain valid credentials to a Redis instance. However, many Redis deployments operate in trusted network environments with minimal authentication requirements, potentially widening the attack surface.

Root Cause

The root cause is classified as CWE-674: Uncontrolled Recursion. The pattern matching algorithm lacks proper recursion depth limits when processing complex or excessively long patterns. Without bounds checking on the recursion depth, maliciously crafted patterns can force the algorithm into a recursive loop that exceeds the available stack space.

Attack Vector

The attack is network-accessible and requires low complexity to execute. An authenticated attacker can send commands with specially crafted pattern arguments to the Redis server. The exploitation mechanism involves:

1. The attacker authenticates to a vulnerable Redis instance
2. The attacker sends a command (such as KEYS or SCAN) with an extremely long or complex pattern string
3. The Redis pattern matching engine attempts to process the pattern recursively
4. The recursion continues without bounds, consuming stack memory
5. Stack overflow occurs, causing the Redis process to crash

The attack results in high availability impact as the Redis service becomes completely unavailable until manually restarted. No integrity or confidentiality impact exists as this is purely a denial-of-service condition.

Detection Methods for CVE-2024-31228

Indicators of Compromise

• Unusual Redis process crashes without apparent resource exhaustion
• Redis log entries showing segmentation faults or stack-related errors
• Repeated authentication attempts followed by pattern-heavy commands
• Abnormally long command arguments in Redis slow logs or monitoring

Detection Strategies

• Monitor Redis command logs for unusually long pattern arguments in KEYS, SCAN, PSUBSCRIBE, FUNCTION LIST, and COMMAND LIST commands
• Configure Redis slowlog-max-len and review slow log entries for suspicious pattern matching operations
• Implement network-level monitoring to detect abnormally large Redis protocol messages
• Deploy application-level logging to track authenticated user activities and command patterns

Monitoring Recommendations

• Enable Redis logging and forward logs to a centralized SIEM for correlation and alerting
• Set up automated alerts for Redis process restarts or unexpected terminations
• Monitor system-level metrics including process stack usage and crash dumps
• Implement Redis CLIENT LIST monitoring to track connected clients and their command histories

How to Mitigate CVE-2024-31228

Immediate Actions Required

• Upgrade Redis to patched versions 6.2.16, 7.2.6, or 7.4.1 immediately
• Review Redis authentication configurations and restrict access to trusted users only
• Audit Redis ACL configurations to limit which commands users can execute
• Implement network segmentation to restrict Redis access to authorized application servers

Patch Information

Redis has released security patches in versions 6.2.16, 7.2.6, and 7.4.1 that address this vulnerability. The fix is available in commit 9317bf64659b33166a943ec03d5d9b954e86afb0. Users should upgrade to the appropriate patched version for their deployment:

• For Redis 6.2.x: Upgrade to 6.2.16 or later
• For Redis 7.2.x: Upgrade to 7.2.6 or later
• For Redis 7.4.x: Upgrade to 7.4.1 or later

Detailed information is available in the GitHub Security Advisory GHSA-66gq-c942-6976 and the GitHub Commit Changes. Debian users should also review the Debian LTS Announcement for distribution-specific guidance.

Workarounds

• No official workarounds are available for this vulnerability according to the Redis security advisory
• Restrict Redis authentication to only essential users and services
• Use Redis ACLs to disable pattern-matching commands (KEYS, SCAN, PSUBSCRIBE) for non-administrative users where operationally feasible
• Deploy Redis behind network firewalls and limit exposure to trusted networks only
• Consider implementing a Redis proxy that validates and sanitizes command arguments

# Example: Restrict pattern-matching commands via Redis ACL
# Create a restricted user that cannot use potentially dangerous commands
ACL SETUSER restricteduser on >password ~* +@all -KEYS -PSUBSCRIBE

# Verify the ACL configuration
ACL LIST

# Monitor for potentially malicious commands
redis-cli SLOWLOG GET 10