CVE-2023-31655 Denial of service in n/a
Attackers can cause a Denial of Service in Redis via unspecified vectors leading to a segmentation violation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-31655?
CVE-2023-31655 is a high-severity denial of service vulnerability in n/a, published on 18 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
redis v7.0.10 was discovered to contain a segmentation violation. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.
Which versions are affected by CVE-2023-31655?
3 open source packages ship an affected version, including keydb, redis and valkey. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
keydb Bitnami | From 7.0.10 | 7.0.11 |
redis Bitnami | From 7.0.10 | 7.0.11 |
valkey Bitnami | From 7.0.10 | 7.0.11 |
Products include Redis Redis.
How do I fix CVE-2023-31655?
Upgrade keydb to 7.0.11 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-31655 being exploited?
There is no known exploitation of CVE-2023-31655 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2022-0543 Debian-specific Redis Server Lua Sandbox Escape
- CVE-2026-23479 redis-server use-after-free in unblock client flow may allow remote code execution
- CVE-2026-25243 redis-server RESTORE invalid memory access may allow remote code execution
- CVE-2025-62507 Redis: Bug in XACKDEL may lead to stack overflow and potential RCE
- CVE-2025-48367 Redis DoS Vulnerability due to bad connection error handling
Sources
Also known as BIT-keydb-2023-31655, BIT-redis-2023-31655, BIT-valkey-2023-31655, GHSA-vcmw-cw7q-cpqq, UBUNTU-CVE-2023-31655.