CVE-2024-51741 Redis allows denial-of-service due to malformed ACL selectors

What is CVE-2024-51741?

CVE-2024-51741 is a medium-severity denial of service vulnerability in redis, published on 6 Jan 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem is fixed in Redis 7.2.7 and 7.4.2.

Weakness: CWE-20

Which versions are affected by CVE-2024-51741?

3 open source packages ship an affected version, including redis, keydb and valkey. It affects 1 product.

Products include Redis Redis.

How do I fix CVE-2024-51741?

Upgrade redis to a fixed version for your release line: 7.2.8 or 7.4.2.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2024-51741 being exploited?

There is no known exploitation of CVE-2024-51741 in the wild and no public exploit code.

Other vulnerabilities in redis

• CVE-2022-0543 Debian-specific Redis Server Lua Sandbox Escape Exploited Critical 10.0
• CVE-2026-23479 redis-server use-after-free in unblock client flow may allow remote code execution High 7.7
• CVE-2026-25243 redis-server RESTORE invalid memory access may allow remote code execution High 7.7
• CVE-2025-62507 Redis: Bug in XACKDEL may lead to stack overflow and potential RCE High 7.7
• CVE-2025-48367 Redis DoS Vulnerability due to bad connection error handling High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2024-51741, AZL-55283, BELL-CVE-2024-51741, BIT-keydb-2024-51741, BIT-redis-2024-51741, BIT-valkey-2024-51741 and 5 more.