CVE-2023-22458: Redis HRANDFIELD/ZRANDMEMBER assertion crash denial of service

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

medium priorityThe flaw only causes denial of service and requires authentication, but the high EPSS score and lack of workarounds raise its operational urgency.

What it is

Redis versions 6.2 and 7.0 before 6.2.9 and 7.0.8 crash on an assertion failure when an authenticated user issues HRANDFIELD or ZRANDMEMBER with specially crafted arguments, rooted in an integer overflow (CWE-190). Because Redis is commonly a shared in-memory data store, a crash takes down the whole instance and any dependent services. No workarounds exist; upgrading is the only fix.

Impact

An attacker with valid credentials can crash the Redis server, causing a denial of service for all clients and applications relying on that instance. There is no data confidentiality or integrity impact per the CVSS vector.

Attack surface

Reached over the Redis command interface by an authenticated user sending crafted HRANDFIELD or ZRANDMEMBER arguments; no user interaction is required. The CVSS vector is AV:L, indicating the scoring assumes local access, though the flaw is triggered through commands.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is high at roughly 0.72 (99th percentile), suggesting elevated likelihood of attempted exploitation.

What to do

• Upgrade Redis to 6.2.9 or 7.0.8 (or later) as the primary fix.
• If immediate upgrade is impossible, restrict command access via ACLs to remove HRANDFIELD and ZRANDMEMBER from untrusted users.
• Enforce strong authentication and least-privilege Redis ACLs so only trusted clients can issue commands.
• Isolate Redis from untrusted networks and avoid exposing it directly to the internet.
• Monitor for repeated crashes and restart loops as an indicator of attempted abuse.

Detection

• Alert on Redis process crashes or assertion failures in server logs, especially around HRANDFIELD or ZRANDMEMBER.
• Monitor for HRANDFIELD and ZRANDMEMBER commands with unusual or oversized arguments via command logging or slowlog.
• Track unexpected Redis restarts or availability gaps in monitoring.
• Watch for repeated authentication and command patterns from a single client preceding a crash.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.