{"id":"CVE-2024-51737","summary":"RediSearch Integer Overflow with LIMIT or KNN arguments can lead to RCE","details":"RediSearch is a Redis module that provides querying, secondary indexing, and full-text search for Redis. An authenticated redis user executing FT.SEARCH or FT.AGGREGATE with a specially crafted LIMIT command argument, or FT.SEARCH with a specially crafted KNN command argument, can trigger an integer overflow, leading to heap overflow and potential remote code execution. This vulnerability is fixed in 2.6.24, 2.8.21, and 2.10.10. Avoid setting value of -1 or large values for configuration parameters MAXSEARCHRESULTS and MAXAGGREGATERESULTS, to avoid exploiting large LIMIT arguments.","aliases":["GHSA-p2pg-67m3-4c76"],"modified":"2026-08-12T15:13:18.149894Z","published":"2025-01-08T15:27:15.780Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-122","CWE-190"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/51xxx/CVE-2024-51737.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/51xxx/CVE-2024-51737.json"},{"type":"ADVISORY","url":"https://github.com/RediSearch/RediSearch/security/advisories/GHSA-p2pg-67m3-4c76"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-51737"},{"type":"FIX","url":"https://github.com/RediSearch/RediSearch/commit/13a2936d921dbe5a2e3c72653e0bd7b26af3a6cb"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/redisearch/redisearch","events":[{"introduced":"d4210355c66584d6cbdcc67228bd508eb8b699cb"},{"introduced":"570ac519556631c90c1b0cf0f4b27665629f3cc3"},{"introduced":"5c1bad6c26db8ab9b2bc1d9106c8f42acaeaf996"},{"fixed":"4700446acf8abf8261b13ea8982c8c96af57a265"},{"fixed":"9b8f722c911112aada75b485acba7c32622c421b"},{"fixed":"c2482d23122181cf8dfb775b4b20729624769f24"},{"fixed":"13a2936d921dbe5a2e3c72653e0bd7b26af3a6cb"}],"database_specific":{"extracted_events":[{"introduced":"2.0.0"},{"fixed":"2.6.24"},{"introduced":"2.8.0"},{"fixed":"2.8.21"},{"introduced":"2.10.0"},{"fixed":"2.10.10"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v2.8.17","v2.8.16","v2.10.6","v2.8.15","v2.10.5","v2.10.4","v2.10.3","v2.8.14","v2.10.2","v2.10.1","v2.8.13","v2.8.12","v2.8.11","v2.8.10","v2.8.9","v2.8.8","v2.8.7","v2.8.6","v2.10.0","v2.8.5","v2.8.4","v2.8.3","v2.8.2","v2.8.1","v2.8.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-51737.json","vanir_signatures_modified":"2026-08-12T15:13:18Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["246540520697679459111967555449880762108","34277177137495846195780422657208522720","121696173923301199906797075687531891770","209690401519509269099472345998473488203","157678696403118317826450878632745265765","114634049831970353538760538593467181712","288958764566636970124558272165588768648","232161767881484070320869078565279859354","92290114986481114587304091423477751954","279691137377529165034960344902626801727","314859399092088569871878022528864194518","335225137924099065004327624863077888215","302922122469378054531826933308828183517","243701160425388051614101417026975242893","154725614080642921236837896587354766406","77427054702969116068680500854863331265","164270777728464837396549244232756137085","143751210973737863943335740873481979923","253409525685322097396313676037069677137","312604893294007363978218270945820282193","330388794959415071889397092729146719734","239729542867757253890518634898676697435","250724634128702260852901353260765429792","291603738605528307234396411543098320188","8378532437140717863165330455343575047"],"threshold":0.9},"id":"CVE-2024-51737-0384b7dc","signature_type":"Line","signature_version":"v1","source":"https://github.com/redisearch/redisearch/commit/13a2936d921dbe5a2e3c72653e0bd7b26af3a6cb","target":{"file":"src/aggregate/aggregate_request.c"}},{"digest":{"function_hash":"61205716681097783241449947887636301054","length":2789},"id":"CVE-2024-51737-097659c8","signature_type":"Function","signature_version":"v1","source":"https://github.com/redisearch/redisearch/commit/13a2936d921dbe5a2e3c72653e0bd7b26af3a6cb","target":{"file":"src/vector_index.c","function":"NewVectorIterator"},"deprecated":false},{"digest":{"line_hashes":["147640482958607675544988115374156417672","227938025543606049500501309287421846747","273298440952659608777639296935894514305","248344598563221509209310697057377521018","53577908033539127868508744892024978204","147307406577900931586793469788185421738","120385774018752468735436505476759070890","16554539937452280384491845186067050908"],"threshold":0.9},"id":"CVE-2024-51737-0f704ff2","signature_type":"Line","signature_version":"v1","source":"https://github.com/redisearch/redisearch/commit/13a2936d921dbe5a2e3c72653e0bd7b26af3a6cb","target":{"file":"src/config.h"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"284111157620867275298629535992872133786","length":199},"id":"CVE-2024-51737-191859f8","signature_type":"Function","signature_version":"v1","source":"https://github.com/redisearch/redisearch/commit/13a2936d921dbe5a2e3c72653e0bd7b26af3a6cb","target":{"file":"src/config.c","function":"CONFIG_SETTER"}},{"target":{"function":"calc_results_len","file":"src/aggregate/aggregate_exec.c"},"deprecated":false,"digest":{"function_hash":"167822719282231417803170614762830175332","length":526},"id":"CVE-2024-51737-2f18e9b6","signature_type":"Function","signature_version":"v1","source":"https://github.com/redisearch/redisearch/commit/13a2936d921dbe5a2e3c72653e0bd7b26af3a6cb"},{"id":"CVE-2024-51737-31d3d22a","signature_type":"Function","signature_version":"v1","source":"https://github.com/redisearch/redisearch/commit/13a2936d921dbe5a2e3c72653e0bd7b26af3a6cb","target":{"function":"CONFIG_SETTER","file":"src/config.c"},"deprecated":false,"digest":{"function_hash":"326989419428702442806420773296391535061","length":317}},{"deprecated":false,"digest":{"function_hash":"303512838760290746094254591427855633584","length":210},"id":"CVE-2024-51737-4f2d240f","signature_type":"Function","signature_version":"v1","source":"https://github.com/redisearch/redisearch/commit/13a2936d921dbe5a2e3c72653e0bd7b26af3a6cb","target":{"function":"CONFIG_GETTER","file":"src/config.c"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/redisearch/redisearch/commit/13a2936d921dbe5a2e3c72653e0bd7b26af3a6cb","target":{"file":"src/aggregate/aggregate_exec.c"},"deprecated":false,"digest":{"line_hashes":["209681313384375161921192865738769573578","217458125609423469374772631508969883074","107712323544809920832863155240275325960","40807904541356341925200995342717110762","177526358889485209009414228820120385211","46557809736975992932101105354592833176","231402739241961272679307752422414535850","77102580830210556123973838303608146309","260549624871665786138060684041364040629","25574911264094732671173433087191597","325111221965327991921478222346969076514","181734817426221991062375670623206211440","178167975961795995149249105744310729898","113942668830126493508531533741574513784","285032673692942035649098421108012269015"],"threshold":0.9},"id":"CVE-2024-51737-50a3260e"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/redisearch/redisearch/commit/13a2936d921dbe5a2e3c72653e0bd7b26af3a6cb","target":{"file":"src/coord/dist_aggregate.c","function":"RSExecDistAggregate"},"deprecated":false,"digest":{"function_hash":"233892096880648448734291605820253721575","length":2378},"id":"CVE-2024-51737-64ff5e85"},{"target":{"function":"getArrangeRP","file":"src/aggregate/aggregate_request.c"},"deprecated":false,"digest":{"function_hash":"251820758489987168650411944494354949160","length":2300},"id":"CVE-2024-51737-679fffae","signature_type":"Function","signature_version":"v1","source":"https://github.com/redisearch/redisearch/commit/13a2936d921dbe5a2e3c72653e0bd7b26af3a6cb"},{"target":{"file":"src/config.c","function":"CONFIG_SETTER"},"deprecated":false,"digest":{"function_hash":"12692421991347460726468770602296202499","length":202},"id":"CVE-2024-51737-6e077a4a","signature_type":"Function","signature_version":"v1","source":"https://github.com/redisearch/redisearch/commit/13a2936d921dbe5a2e3c72653e0bd7b26af3a6cb"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/redisearch/redisearch/commit/13a2936d921dbe5a2e3c72653e0bd7b26af3a6cb","target":{"file":"src/module.c","function":"prepareOptionalTopKCase"},"deprecated":false,"digest":{"function_hash":"93737727169055602161913722671246396221","length":1374},"id":"CVE-2024-51737-9b52a5c8"},{"digest":{"line_hashes":["317471402895993221204005238752263396292","230650690036049138607483417043828545787","151479849334492132318614755359898870158","24423193617509458330085818259688596332"],"threshold":0.9},"id":"CVE-2024-51737-9ced0626","signature_type":"Line","signature_version":"v1","source":"https://github.com/redisearch/redisearch/commit/13a2936d921dbe5a2e3c72653e0bd7b26af3a6cb","target":{"file":"src/vector_index.c"},"deprecated":false},{"id":"CVE-2024-51737-a03a39fb","signature_type":"Line","signature_version":"v1","source":"https://github.com/redisearch/redisearch/commit/13a2936d921dbe5a2e3c72653e0bd7b26af3a6cb","target":{"file":"src/buffer.c"},"deprecated":false,"digest":{"line_hashes":["85637266535353450915334012820862742993","151217297777866205322117143881942833088","211726729225592696156291574203986241675","186035036930103949845277321825941152389","249143204385484843963810953352436409929"],"threshold":0.9}},{"source":"https://github.com/redisearch/redisearch/commit/13a2936d921dbe5a2e3c72653e0bd7b26af3a6cb","target":{"file":"src/config.c","function":"RSConfig_GetInfoString"},"deprecated":false,"digest":{"function_hash":"260488494975825426561538900800460460885","length":1346},"id":"CVE-2024-51737-a4283d49","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["175517707426704648291315074362430436110","250044643982136892205215991715848027598","281826948557799051471604131891632374310","265741526867696727348185062621651491374","26321745992956117925212331197811985937","265551804367285218540364412535581444169","211321448641259993450159407882123213621","150989066816090424036235221805552203024"],"threshold":0.9},"id":"CVE-2024-51737-b75ee479","signature_type":"Line","signature_version":"v1","source":"https://github.com/redisearch/redisearch/commit/13a2936d921dbe5a2e3c72653e0bd7b26af3a6cb","target":{"file":"src/module.c"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/redisearch/redisearch/commit/13a2936d921dbe5a2e3c72653e0bd7b26af3a6cb","target":{"file":"src/coord/dist_aggregate.c"},"deprecated":false,"digest":{"line_hashes":["157426986578741910143086278750393421402","17496711507067491223718748935543683449","277828960298294243364242104950380982223","7800336252730099721731136753486660046"],"threshold":0.9},"id":"CVE-2024-51737-bd073218"},{"digest":{"line_hashes":["289710581228377352448161764873596516614","51800897614630691408779893093423823710","297011128067708858582326972015257704102","680306995090670604236529499408775303","11266332495593373308664920437281361722","214523671061981018115074708466688152051","310009780160232313261895361519802558248","276712976208064458119094983060389195616","296614895093217329589356966585151316563","85995279712858113756023034713185794168","183901947971700936954184252854542708358","92759875683477294156007054679327663310","48806359027848717718511696736392660783","272463139960980165690996771286580327101","75503693324383623404738343187430072070","199615541858907827289651554879364026052","256487317253087504511609697610769126037","118971110410100019768410454752135570840","48289685579413067730453027994855235464","154899740436767120952485765480406408320","207935204180302391370546939410118325160","281788642694772246163404899683856996763","276712976208064458119094983060389195616","296614895093217329589356966585151316563","85995279712858113756023034713185794168","240590463960949277023949095993014070527","159953781292307669880552851973758592859","162231162564602906873892543672175558833","257160771181484603019227643177280890206","258652439767818010292970541788565186820","330867536285157863132792008480326948411","132362773248266205238025591755677790933","166165532206726168434865070716302121355","212428692348668303992411923065789764595","82794545904988379003819291500996867344","151098982112610457955484445864238408778","95180644018716986611459432516978035704","96605702252432965400827385193197742248"],"threshold":0.9},"id":"CVE-2024-51737-dba1eaf6","signature_type":"Line","signature_version":"v1","source":"https://github.com/redisearch/redisearch/commit/13a2936d921dbe5a2e3c72653e0bd7b26af3a6cb","target":{"file":"src/config.c"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"276221820581033729596323451463230380965","length":293},"id":"CVE-2024-51737-ddf003ac","signature_type":"Function","signature_version":"v1","source":"https://github.com/redisearch/redisearch/commit/13a2936d921dbe5a2e3c72653e0bd7b26af3a6cb","target":{"file":"src/buffer.c","function":"Buffer_Grow"}},{"target":{"file":"src/aggregate/aggregate_exec.c","function":"AREQ_Execute"},"deprecated":false,"digest":{"function_hash":"64249343675385985006101603794802501990","length":174},"id":"CVE-2024-51737-e61690b9","signature_type":"Function","signature_version":"v1","source":"https://github.com/redisearch/redisearch/commit/13a2936d921dbe5a2e3c72653e0bd7b26af3a6cb"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/redisearch/redisearch/commit/13a2936d921dbe5a2e3c72653e0bd7b26af3a6cb","target":{"function":"CONFIG_GETTER","file":"src/config.c"},"deprecated":false,"digest":{"function_hash":"72179721595094387641652310517476701924","length":204},"id":"CVE-2024-51737-ed1ac494"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}