Security readout for executives and security teams
Plain-English summary
CVE-2026-24814 is a critical integer overflow issue in swoole-src before 6.0.2, specifically in bundled thirdparty/hiredis code. The public record rates it CVSS 10.0, meaning successful exploitation could have severe business impact. Public sources provided do not show active exploitation or detailed attack conditions.
Executive priority
Treat this as urgent for environments using swoole-src, due to the critical score and unauthenticated network attack vector. Prioritize rapid inventory and upgrade planning. Do not assume exploitation is occurring unless new evidence appears from KEV or trusted vendor reporting.
Technical view
The CVE describes CWE-190 integer overflow or wraparound in swoole/swoole-src thirdparty/hiredis modules, associated with sds.C. Affected versions are before 6.0.2. The CVSS v4.0 vector indicates network reachability, low complexity, no privileges, no user interaction, and high confidentiality, integrity, and availability impact.
Likely exposure
Organizations may be exposed if they build, package, or run software based on swoole-src before 6.0.2, especially where the bundled hiredis module is included. The sources do not specify which runtime configurations or code paths are required to trigger the flaw.
Exploitation context
No CISA KEV listing is provided, and the supplied sources do not report active exploitation. The CVSS vector suggests remote, unauthenticated exploitability, but public details in the bundle are limited and do not describe a working exploit or precise trigger.
Researcher notes
Public detail is sparse. The record identifies an integer overflow in thirdparty/hiredis sds.C and points to a patch PR. Further assessment should focus on affected code reachability in local builds, version lineage, and whether downstream packages backported the fix without changing version labels.
Mitigation direction
- Upgrade swoole-src to 6.0.2 or later where applicable.
- Review the linked upstream pull request for patch context.
- Check vendor or distribution advisories for packaged update availability.
- Prioritize internet-facing or Redis-integrated deployments first.
Validation and detection
- Inventory all products and builds using swoole-src.
- Confirm whether versions are before 6.0.2.
- Check whether bundled thirdparty/hiredis code is present.
- Verify deployed packages include the upstream fix.
- Monitor CVE and vendor pages for updated guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-190: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-24814 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 10 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:U/V:C/RE:L/U:Red
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:U/V:C/RE:L/U:Red——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
10CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:U/V:C/RE:L/U:Red
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/swoole/swoole-src/pull/5698CVE reference · patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.