CVE-2018-11219

Imagine Redis has a feature for running small Lua scripts, like a “programmable toolbox.” This bug is like a mistake in how the toolbox measures sizes—an attacker can feed it a specially crafted input so it stops checking limits correctly. That can let Redis crash, leak data, or potentially be taken over.

This matters if your business runs Redis (including embedded/packaged Redis) in versions before 3.2.12, 4.x before 4.0.10, or 5.x before 5.0 RC2. The findings say it is reachable over the network with no authentication and no user interaction, and it is considered reachable in the default configuration.

Reachability gate: only avoid risk if your Redis is already on a fixed version, or the vulnerable Lua subsystem is not present/enabled in the running build.

Treat this as urgent because attackers are able to trigger it remotely without authentication, and public exploits are available. Since it breaks bounds checking, the impact can go beyond a simple crash—up to full compromise—so you should upgrade on the earliest possible schedule.