high
CVE-2024-31449
Lua library stack overflow via a crafted EVAL script -> remote code execution as the Redis process
- Severity
- high
- Affected product
- Redis
- Affected versions
- Redis ≥ 7.0.0, < 7.2.5
- Fixed in
- Redis 7.2.5
- Added to NewScan
- 2026-08-06
- Detected by
- NewScan — free, self-hosted
How NewScan reports it
COMPONENT VERSION RANGE
NewScan fingerprints Redis from its response and reports this CVE when the detected version falls inside the affected range below.
Ranges taken from the Redis security advisory (2026-08-05 review), not inferred. Redis backports per maintained branch, so each CVE is ONE ROW PER BRANCH the advisory names a fixed version for - a branch the advisory does not list gets no row rather than a guessed range, so an older patched line is never falsely flagged. Needs permission to run EVAL, which an unauthenticated instance grants to everyone.
References
Scan for this yourself — local, in-band scanning is free.
Get NewScan (FREE) →