Impact

When using the Redis Lua Debugger, users can send malformed requests that cause the debugger’s protocol parser to read data beyond the actual buffer. This issue affects all versions of Redis with Lua debugging support (3.2 or newer).

Patches

The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14.

Credit

This problem was found by Meir Shpilraien.

For more information

If you have any questions or comments about this advisory:

• Open an issue in the Redis repository
• Email us at redis@redis.io