cve 2022 24736

CVE-2022-24736 is a denial-of-service vulnerability in Redis that allows a malformed Lua script to trigger a NULL-pointer dereference, crashing the redis-server process. The flaw was fixed upstream in Redis versions 6.2.7 and 7.0.0. For environments that cannot immediately patch, practical mitigations include blocking SCRIPT LOAD and EVAL commands using ACLs, and restricting which users can submit Lua code to Redis. This tag covers discussions on the vulnerability details, patching strategies, and mitigation best practices for securing Redis deployments against this specific Lua-based DoS attack.