Buffer overflow in Redistimeseries
CVE-2024-51480
RedisTimeSeries is a time-series database (TSDB) module for Redis, by Redis. Executing one of these commands TS.QUERYINDEX, TS.MGET, TS.MRAGE, TS.MREVRANGE by an authenticated user, using specially crafted command arguments may cause an integer overflow, a subsequent heap overflow, and potentially lead to remote code execution. This vulnerability is fixed in 1.6.20, 1.8.15, 1.10.15, and 1.12.3.
Vulnerability class: Buffer Overflow
EPSS: 0.002 (10.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.0 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Redistimeseries — versions >= 1.0.0, < 1.6.20, >= 1.8.0, < 1.8.15, >= 1.10.0, < 1.10.15
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2024-51480?
- CVE-2024-51480 is a high-severity vulnerability in Redistimeseries, classified under Heap-based Buffer Overflow. CVSS score: 7.0/10. Published 2025-01-08.
- How severe is CVE-2024-51480?
- High severity. CVSS v3 base score is 7.0 out of 10.
- Is CVE-2024-51480 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.