← Vulnerability feed

Vulnerability record · CVE-2016-8339 · published 28 October 2016

CVE-2016-8339: Redislabs redis out-of-bounds write vulnerability

Redislabs · Redis

A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. An out of bounds write vulnerability exists in the handling of the client-output-buffer-limit option during the CONFIG SET command for the Redis data structure store. A crafted CONFIG SET command can lead to an out of bounds write potentially resulting in code execution.

9.8 CVSS 3.1 Critical EPSS 15% · top 3.4% CWE-787 · Out-of-bounds write
9.8CVSS 3.1 base score, v2 7.5
15%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. An out of bounds write vulnerability exists in the handling of the client-output-buffer-limit option during the CONFIG SET command for the Redis data structure store. A crafted CONFIG SET command can lead to an out of bounds write potentially resulting in code execution.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.securityfocus.com/bid/93283 Third Party AdvisoryVDB Entry
http://www.talosintelligence.com/reports/TALOS-2016-0206/ ExploitThird Party Advisory
https://github.com/antirez/redis/commit/6d9f8e2462fc2c426d48c941edeb78e5df7d2977 PatchThird Party Advisory
https://security.gentoo.org/glsa/201702-16 Third Party Advisory
http://www.securityfocus.com/bid/93283 Third Party AdvisoryVDB Entry
http://www.talosintelligence.com/reports/TALOS-2016-0206/ ExploitThird Party Advisory
https://github.com/antirez/redis/commit/6d9f8e2462fc2c426d48c941edeb78e5df7d2977 PatchThird Party Advisory
https://security.gentoo.org/glsa/201702-16 Third Party Advisory

Track CVE-2016-8339 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2015-4335Redislabs redis vulnerabilityRedis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.EPSS 9.5%9.8CVE-2018-11218Redis cmsgpack Lua library stack buffer overflow memory corruptionRedis versions before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 contain a stack-based buffer overflow in the cmsgpack library used by the Lua…EPSS 59%analysed9.8CVE-2018-11219Redislabs redis integer overflow vulnerabilityAn Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2…EPSS 7.0%9.8CVE-2017-15047Redislabs redis memory buffer overflow vulnerabilityThe clusterLoadConfig function in cluster.c in Redis 4.0.2 allows attackers to cause a denial of service (out-of-bounds array index and application c…EPSS 1.8%8.8CVE-2021-32625Redislabs redis integer overflow vulnerabilityRedis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Red…EPSS 4.3%8.8CVE-2021-29477Redislabs redis integer overflow vulnerabilityRedis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Red…EPSS 4.2%8.8CVE-2021-29478Redislabs redis integer overflow vulnerabilityRedis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Red…EPSS 3.6%8.8CVE-2021-21309Redislabs redis integer overflow vulnerabilityRedis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 …EPSS 4.8%

Source: NIST National Vulnerability Database (record CVE-2016-8339), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.