CVE-2024-51737

Summary

CVE-2024-51737 is a vulnerability affecting RediSearch, a Redis module used for querying, secondary indexing, and full-text search. An authenticated Redis user can manipulate the LIMIT command argument in the FT.SEARCH or FT.AGGREGATE functions, or the KNN command argument in FT.SEARCH, to trigger an integer overflow. This, in turn, results in a heap overflow, potentially enabling remote code execution. To mitigate this issue, avoid setting large values, particularly -1, for the configuration parameters MAXSEARCHRESULTS and MAXAGGREGATERESULTS. This vulnerability has been addressed in Redis versions 2.6.24, 2.8.21, and 2.10.10.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.