This Week
Get Alerts ›
cvehawk_ Get Alerts
Software · Redis

Redis Vulnerabilities

The latest security flaws in Redis, which ones attackers are using, and whether your version is affected.

New flaws, 30 days
0
Critical, 8 weeks
0
On CISA's exploited list
1
Latest exploited
28 Mar 2022

Run redis-server --version, or INFO server in redis-cli.

Redis Security in Short

Redis is the cache, session store and queue behind many web apps. Its worst flaws are in its Lua scripting, and they let anyone who can run commands take over the server. So the biggest risk is a Redis that the internet can reach: scanners find exposed Redis servers within minutes.

How to Keep Redis Safe

  • Never expose Redis to the internet. Bind it to 127.0.0.1 or a private network, and firewall port 6379.
  • Set a password (requirepass, or ACL users on Redis 6 and later).
  • Update to a fixed release when one comes out, then restart Redis.
  • If you don't use Lua scripts, you can block EVAL and EVALSHA with ACLs.

The Past Eight Weeks

No new Redis flaws were published in the past eight weeks.

Rather not patch it yourself?

Bobble Solutions patches, backs up and watches Linux servers and WordPress sites.

Talk to Bobble Solutions