How many CVEs does Redis have?

Redis has 82 published CVE records since 2015, including 17 in the last two years.

How many Redis CVEs are in CISA KEV?

Yes — 1 of Redis's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which Redis products have the most CVEs?

The Redis products with the most published CVEs are redis, redisgraph, hiredis, redis-py, go-redis.

What are the most common weakness types in Redis CVEs?

Redis's CVEs most often map to these CWE weakness types: CWE-190 (Integer Overflow or Wraparound), CWE-20 (Improper Input Validation), CWE-680 (Integer Overflow to Buffer Overflow), CWE-416 (Use After Free).

Are there public exploits for Redis vulnerabilities?

Yes — 22 of Redis's CVEs have a known public exploit.

How many critical Redis vulnerabilities are there?

Redis has 13 critical and 46 high-severity CVEs.

What is the average severity of Redis CVEs?

The average CVSS base score across Redis's scored CVEs is 7.4.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

82 CVEs

1 in CISA KEV

Redis Vulnerabilities

Name: Redis vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for Redis.

82

Total CVEs

Published

1

In CISA KEV

Exploited in the wild

22

Public exploits

PoC or exploit code

7.4

Avg CVSS

2015–2026

Overview

Redis has 82 published CVE records since 2015, of which 1 are in CISA's Known Exploited Vulnerabilities catalog and 22 have a known public exploit. The average CVSS base score across scored CVEs is 7.4.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Redis products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on Redis's vulnerability posture, as a share of its 82 published CVEs.

Average CVSS: 7.4
Critical / high: 72%
Actively exploited (KEV): 1%
Public exploit available: 27%
Patch available: 95%

Severity and exploitation

How the CVSS severity of Redis's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical13

High46

Medium17

Low6

In CISA’s Known Exploited Vulnerabilities catalog

1

One of Redis's CVEs is confirmed exploited in the wild.

Public exploits

22

22 of Redis's CVEs have a known public exploit available.

Most affected products

The Redis products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in Redis CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish Redis CVE records.

Disclosure activity by year

How many Redis CVEs were published each year.

2019

5

2020

3

2021

17

2022

8

2023

16

2024

6

2025

13

2026

4

Latest Redis CVEs

The most recently disclosed vulnerabilities affecting Redis.

High vulnerability · 2026-07-25
CWE-415
High · CVSS 7.5
EPSS 0.5%2026-07-25
redis-server RESTORE invalid memory access may allow remote code execution
CWE-122
High · CVSS 7.7
EPSS 3.3%2026-05-05
redis-server Lua use-after-free may allow remote code execution
CWE-416
Medium · CVSS 6.1
EPSS 1.8%2026-05-05
redis-server use-after-free in unblock client flow may allow remote code execution
CWE-416
High · CVSS 7.7
EPSS 1.3%2026-05-05
Redis: Bug in XACKDEL may lead to stack overflow and potential RCE
CWE-20
High · CVSS 7.7
EPSS 6.9%2025-11-04
Redis Lua Use-After-Free may lead to remote code execution
CWE-416
Critical · CVSS 10.0
EPSS 86.8%2025-10-03
Redis is vulnerable to DoS via specially crafted LUA scripts
CWE-190
High · CVSS 7.1
EPSS 1.0%2025-10-03
Redis: Authenticated users can execute LUA scripts as a different user
CWE-94
High · CVSS 7.3
EPSS 0.7%2025-10-03
Lua library commands may lead to integer overflow and potential RCE
CWE-190
High · CVSS 8.8
EPSS 3.7%2025-10-03
Low vulnerability · 2025-07-23
CWE-401
Low · CVSS 3.5
EPSS 0.3%2025-07-23
Redis DoS Vulnerability due to bad connection error handling
CWE-770
High · CVSS 7.5
EPSS 0.7%2025-07-07
Redis allows out of bounds writes in hyperloglog commands leading to RCE
CWE-680
High · CVSS 7.8
EPSS 4.0%2025-07-07

Track new Redis CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor Redis CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

Langflow82 CVEs Netty82 CVEs xpdfreader82 CVEs caldera82 CVEs Combodo82 CVEs GTKWave82 CVEs OS4ED82 CVEs Sony82 CVEs

Browse all vendors

Frequently asked questions

Common questions about Redis vulnerabilities.

How many CVEs does Redis have?: Redis has 82 published CVE records since 2015, including 17 in the last two years.
How many Redis CVEs are in CISA KEV?: Yes — 1 of Redis's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Which Redis products have the most CVEs?: The Redis products with the most published CVEs are redis, redisgraph, hiredis, redis-py, go-redis.
What are the most common weakness types in Redis CVEs?: Redis's CVEs most often map to these CWE weakness types: CWE-190 (Integer Overflow or Wraparound), CWE-20 (Improper Input Validation), CWE-680 (Integer Overflow to Buffer Overflow), CWE-416 (Use After Free).
Are there public exploits for Redis vulnerabilities?: Yes — 22 of Redis's CVEs have a known public exploit.
How many critical Redis vulnerabilities are there?: Redis has 13 critical and 46 high-severity CVEs.
What is the average severity of Redis CVEs?: The average CVSS base score across Redis's scored CVEs is 7.4.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Redis vulnerabilities

Monitor new Redis vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing