The vulnerability lies in the hiredis RESP aggregate parser, where an attacker can send crafted input that causes the library to allocate an excessive amount of memory. This uncontrolled allocation, a flaw cataloged as CWE-770 and CWE-789, can exhaust system resources and lead to application slowdown or crash, resulting in a denial of service impact.

The flaw affects any deployment using the hiredis client library that contains commit 29ea279, which is part of releases after v1.5.0. No vendor or product name is listed, and specific affected versions are not detailed beyond the mention of post‑v1.5.0. Applications that embed hiredis and rely on the RESP aggregate parser should review their version and be prepared to upgrade.

The CVSS score of 7.5 indicates a high severity rating. The EPSS score is 0.0039, indicating a very low probability of exploitation but not zero, so it should still be considered. The vulnerability is not listed in the CISA KEV catalog. Likely, exploitation requires that the attacker can send crafted RESP messages to a service that uses hiredis; thus, the attack vector is inferred to be remote network access to the associated service.