CVE-2016-10517: networking.c in Redis before 3.2.7 allows "Cross Protocol Scripting" because it lacks a check for POST and...

Security readout for executives and security teams

This flaw affects Redis before 3.2.7. Redis did not reject HTTP-style POST or Host strings sent to its TCP port, enabling cross-protocol scripting when an attacker could cause an HTTP request to reach Redis. Business risk is highest where old Redis instances are reachable from untrusted networks. Exposure is likely limited to Redis deployments older than 3.2.7, especially instances with Redis TCP ports reachable by browsers, internal web clients, or untrusted networks. The source bundle does not provide CPEs or a complete affected-product matrix. Treat as a targeted cleanup item unless old Redis is exposed to untrusted networks. Prioritize exposed or business-critical Redis services first, because protocol confusion can cross trust boundaries when network access is weak. Mitigation focus: Upgrade Redis deployments before 3.2.7 to Redis 3.2.7 or later.; Restrict Redis TCP access to trusted hosts and private networks only.; Review vendor or distribution advisories for supported fixed package versions..

Prepared

Jun 12, 2026, 20:36 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.