CVE-2023-41056: High Heap Overflow in Redis 7.0 and 7.2

CVE-2023-41056 is a high severity heap overflow in Redis, scored 8.1. Incorrect handling of buffer resizing can cause an integer overflow and possible remote code execution. It affects Redis 7.0.9 and newer, including 7.2.x. Upgrade to 7.0.15 or 7.2.4, and keep Redis off untrusted networks.

What's affected

The Redis security advisory GHSA-xr47-pcmx-fq2m, published on 9 January 2024, lists the affected versions as 7.0.9 or newer, including 7.2.x, and the patched versions as 7.0.15 and 7.2.4. It rates the issue High with a CVSS score of 8.1. The weaknesses in the record are CWE-190, integer overflow, and CWE-762, mismatched memory management routines.

The release notes for both fixed versions list the security fix: Redis may incorrectly handle the resizing of memory buffers, which can result in incorrect accounting of buffer sizes and lead to a heap overflow and potential remote code execution. Fedora 38 and 39 appear in the record's product list, and the record also cites a NetApp advisory that I did not open.

NVD and the Redis advisory agree on the score and vector: network, high attack complexity, no privileges, no user interaction, with high impact on all three areas. The high attack complexity is why the score stops at 8.1.

I found no workaround in the advisory text I read. It is not in CISA's KEV catalog, and the advisory does not say it is exploited in the wild.

How to check if you're exposed

Check the server version on every host, in every container and in every managed image that runs Redis.

redis-server --version
redis-cli INFO server | grep redis_version

For containers, look at the image tags that are running:

docker ps --format "{{.Names}} {{.Image}}"
docker image ls redis

Anything from 7.0.9 up to 7.0.14, or 7.2.0 up to 7.2.3, is in range. Linux distributions often backport fixes without changing the version number, so for a packaged Redis, check the distribution's security tracker or the package changelog as well:

rpm -q --changelog redis | grep CVE-2023-41056
apt changelog redis-server | grep CVE-2023-41056

Remember that Redis is also embedded in other products and managed services. Ask vendors and cloud providers which version they run, and look in your software bill of materials for redis components.

What to do now

1. Inventory every Redis instance, including those inside containers, appliances and application bundles.
2. Upgrade 7.0 instances to 7.0.15 or later, and 7.2 instances to 7.2.4 or later. Test with your client libraries and cluster settings first, since the 7.2.4 notes also mention cluster fixes.
3. Make sure Redis is not reachable from untrusted networks. Bind it to private interfaces, firewall the port and require authentication.
4. Rebuild and redeploy container images from the patched base, then confirm the running version in production.
5. Add a check to your pipeline so a build that pulls an older Redis fails or raises an alert.

Why it matters

The bug sits in memory management. When Redis resizes a buffer, its accounting of the buffer size can be wrong. The result is a heap overflow, where data is written past the end of the allocation, and heap overflows in network-facing services can sometimes be turned into code execution.

Redis is trusted infrastructure in many stacks, which raises the stakes. It often holds sessions, queues and caches, runs close to application servers and is sometimes left open inside a private network. The attack complexity is high, so this is not the easiest kind of flaw, but patching is cheap compared with what an intrusion would cost. The advisory points to a fix inside each supported 7.x line, so there is no need to jump a major version.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Redis security advisory GHSA-xr47-pcmx-fq2m
• Redis 7.2.4 release notes
• Redis 7.0.15 release notes
• Safeguard Gold entry for CVE-2023-41056

Last reviewed: 19 October 2026.