Every CVE Search/ Get API key

CVE-2021-21309

Integer overflow on 32-bit systems

5.4 MediumFix available

Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and potentially result with remote code execution. Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the limit is significantly increased, receiving a large request from a client may trigger several integer overflow scenarios, which would result with buffer overflow and heap corruption. We believe this could in certain conditions be exploited for remote code execution. By default, authenticated Redis users have access to all configuration parameters and can therefore use the “CONFIG SET proto-max-bulk-len” to change the safe default, making the system vulnerable. This problem only affects 32-bit Redis (on a 32-bit system, or as a 32-bit executable running on a 64-bit system). The problem is fixed in version 6.2, and the fix is back ported to 6.0.11 and 5.0.11. Make sure you use one of these versions if you are running 32-bit Redis. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent clients from directly executing CONFIG SET: Using Redis 6.0 or newer, ACL configuration can be used to block the command. Using older versions, the rename-command configuration directive can be used to rename the command to a random string unknown to users, rendering it inaccessible. Please note that this workaround may have an additional impact on users or operational systems that expect CONFIG SET to behave in certain ways.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
Low

Exploit likelihood

4.79%Up 2.5 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 5.4

Integer overflow on 32-bit systems

Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and potentially result with remote code execution. Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the limit is significantly increased, receiving a large request from a client may trigger several integer overflow scenarios, which would result with buffer overflow and heap corruption. We believe this could in certain conditions be exploited for remote code execution. By default, authenticated Redis users have access to all configuration parameters and can therefore use the “CONFIG SET proto-max-bulk-len” to change the safe default, making the system vulnerable. This problem only affects 32-bit Redis (on a 32-bit system, or as a 32-bit executable running on a 64-bit system). The problem is fixed in version 6.2, and the fix is back ported to 6.0.11 and 5.0.11. Make sure you use one of these versions if you are running 32-bit Redis. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent clients from directly executing CONFIG SET: Using Redis 6.0 or newer, ACL configuration can be used to block the command. Using older versions, the rename-command configuration directive can be used to rename the command to a random string unknown to users, rendering it inaccessible. Please note that this workaround may have an additional impact on users or operational systems that expect CONFIG SET to behave in certain ways.

Record
CVE-2021-21309
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L
Weakness
CWE-190
Updated
2026-11-02
EUVDEUVD-2021-8663 5.4

Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and potentially result with remote code execution. Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the limit is significantly increased, receiving a large request from a client may trigger several integer overflow scenarios, which would result with buffer overflow and heap corruption. We believe this could in certain conditions be exploited for remote code execution. By default, authenticated Redis users have access to all configuration parameters and can therefore use the “CONFIG SET proto-max-bulk-len” to change the safe default, making the system vulnerable. This problem only affects 32-bit Redis (on a 32-bit system, or as a 32-bit executable running on a 64-bit system). The problem is fixed in version 6.2, and the fix is back ported to 6.0.11 and 5.0.11. Make sure you use one of these versions if you are running 32-bit Redis. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent clients from directly executing CONFIG SET: Using Redis 6.0 or newer, ACL configuration can be used to block the command. Using older versions, the rename-command configuration directive can be used to rename the command to a random string unknown to users, rendering it inaccessible. Please note that this workaround may have an additional impact on users or operational systems that expect CONFIG SET to behave in certain ways.

Record
EUVD-2021-8663
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L
Updated
2026-11-03
NVD 5.4

Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and potentially result with remote code execution. Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the limit is significantly increased, receiving a large request from a client may trigger several integer overflow scenarios, which would result with buffer overflow and heap corruption. We believe this could in certain conditions be exploited for remote code execution. By default, authenticated Redis users have access to all configuration parameters and can therefore use the “CONFIG SET proto-max-bulk-len” to change the safe default, making the system vulnerable. This problem only affects 32-bit Redis (on a 32-bit system, or as a 32-bit executable running on a 64-bit system). The problem is fixed in version 6.2, and the fix is back ported to 6.0.11 and 5.0.11. Make sure you use one of these versions if you are running 32-bit Redis. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent clients from directly executing CONFIG SET: Using Redis 6.0 or newer, ACL configuration can be used to block the command. Using older versions, the rename-command configuration directive can be used to rename the command to a random string unknown to users, rendering it inaccessible. Please note that this workaround may have an additional impact on users or operational systems that expect CONFIG SET to behave in certain ways.

Record
CVE-2021-21309
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness
CWE-190
Updated
2026-11-02
OSVALPINE-CVE-2021-21309 8.8

Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and potentially result with remote code execution. Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the limit is significantly increased, receiving a large request from a client may trigger several integer overflow scenarios, which would result with buffer overflow and heap corruption. We believe this could in certain conditions be exploited for remote code execution. By default, authenticated Redis users have access to all configuration parameters and can therefore use the “CONFIG SET proto-max-bulk-len” to change the safe default, making the system vulnerable. This problem only affects 32-bit Redis (on a 32-bit system, or as a 32-bit executable running on a 64-bit system). The problem is fixed in version 6.2, and the fix is back ported to 6.0.11 and 5.0.11. Make sure you use one of these versions if you are running 32-bit Redis. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent clients from directly executing CONFIG SET: Using Redis 6.0 or newer, ACL configuration can be used to block the command. Using older versions, the rename-command configuration directive can be used to rename the command to a random string unknown to users, rendering it inaccessible. Please note that this workaround may have an additional impact on users or operational systems that expect CONFIG SET to behave in certain ways.

Record
ALPINE-CVE-2021-21309
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVAZL-6843 8.8

CVE-2021-21309 affecting package redis for versions less than 5.0.5-7

Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and potentially result with remote code execution. Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the limit is significantly increased, receiving a large request from a client may trigger several integer overflow scenarios, which would result with buffer overflow and heap corruption. We believe this could in certain conditions be exploited for remote code execution. By default, authenticated Redis users have access to all configuration parameters and can therefore use the “CONFIG SET proto-max-bulk-len” to change the safe default, making the system vulnerable. This problem only affects 32-bit Redis (on a 32-bit system, or as a 32-bit executable running on a 64-bit system). The problem is fixed in version 6.2, and the fix is back ported to 6.0.11 and 5.0.11. Make sure you use one of these versions if you are running 32-bit Redis. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent clients from directly executing CONFIG SET: Using Redis 6.0 or newer, ACL configuration can be used to block the command. Using older versions, the rename-command configuration directive can be used to rename the command to a random string unknown to users, rendering it inaccessible. Please note that this workaround may have an additional impact on users or operational systems that expect CONFIG SET to behave in certain ways.

Record
AZL-6843
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBELL-CVE-2021-21309 8.8

CVE-2021-21309 does not affect BellSoft software

Record
BELL-CVE-2021-21309
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 10 moreShow less
OSV 8.8

Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and potentially result with remote code execution. Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the limit is significantly increased, receiving a large request from a client may trigger several integer overflow scenarios, which would result with buffer overflow and heap corruption. We believe this could in certain conditions be exploited for remote code execution. By default, authenticated Redis users have access to all configuration parameters and can therefore use the “CONFIG SET proto-max-bulk-len” to change the safe default, making the system vulnerable. This problem only affects 32-bit Redis (on a 32-bit system, or as a 32-bit executable running on a 64-bit system). The problem is fixed in version 6.2, and the fix is back ported to 6.0.11 and 5.0.11. Make sure you use one of these versions if you are running 32-bit Redis. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent clients from directly executing CONFIG SET: Using Redis 6.0 or newer, ACL configuration can be used to block the command. Using older versions, the rename-command configuration directive can be used to rename the command to a random string unknown to users, rendering it inaccessible. Please note that this workaround may have an additional impact on users or operational systems that expect CONFIG SET to behave in certain ways.

Record
CVE-2021-21309
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2021-21309 8.8

Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and potentially result with remote code execution. Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the limit is significantly increased, receiving a large request from a client may trigger several integer overflow scenarios, which would result with buffer overflow and heap corruption. We believe this could in certain conditions be exploited for remote code execution. By default, authenticated Redis users have access to all configuration parameters and can therefore use the “CONFIG SET proto-max-bulk-len” to change the safe default, making the system vulnerable. This problem only affects 32-bit Redis (on a 32-bit system, or as a 32-bit executable running on a 64-bit system). The problem is fixed in version 6.2, and the fix is back ported to 6.0.11 and 5.0.11. Make sure you use one of these versions if you are running 32-bit Redis. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent clients from directly executing CONFIG SET: Using Redis 6.0 or newer, ACL configuration can be used to block the command. Using older versions, the rename-command configuration directive can be used to rename the command to a random string unknown to users, rendering it inaccessible. Please note that this workaround may have an additional impact on users or operational systems that expect CONFIG SET to behave in certain ways.

Record
DEBIAN-CVE-2021-21309
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2021-1093 9.8

redis security update

Redis is an advanced key-value store. It is often referred to as a dattructure server since keys can contain strings, hashes ,lists, sets anorted sets.

Security Fix(es):

Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and potentially result with remote code execution. Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the limit is significantly increased, receiving a large request from a client may trigger several integer overflow scenarios, which would result with buffer overflow and heap corruption. We believe this could in certain conditions be exploited for remote code execution. By default, authenticated Redis users have access to all configuration parameters and can therefore use the “CONFIG SET proto-max-bulk-len” to change the safe default, making the system vulnerable. This problem only affects 32-bit Redis (on a 32-bit system, or as a 32-bit executable running on a 64-bit system). The problem is fixed in version 6.2, and the fix is back ported to 6.0.11 and 5.0.11. Make sure you use one of these versions if you are running 32-bit Redis. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent clients from directly executing CONFIG SET: Using Redis 6.0 or newer, ACL configuration can be used to block the command. Using older versions, the rename-command configuration directive can be used to rename the command to a random string unknown to users, rendering it inaccessible. Please note that this workaround may have an additional impact on users or operational systems that expect CONFIG SET to behave in certain ways.(CVE-2021-21309)

Record
OESA-2021-1093
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-21309 8.8

Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and potentially result with remote code execution. Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the limit is significantly increased, receiving a large request from a client may trigger several integer overflow scenarios, which would result with buffer overflow and heap corruption. We believe this could in certain conditions be exploited for remote code execution. By default, authenticated Redis users have access to all configuration parameters and can therefore use the “CONFIG SET proto-max-bulk-len” to change the safe default, making the system vulnerable. This problem only affects 32-bit Redis (on a 32-bit system, or as a 32-bit executable running on a 64-bit system). The problem is fixed in version 6.2, and the fix is back ported to 6.0.11 and 5.0.11. Make sure you use one of these versions if you are running 32-bit Redis. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent clients from directly executing CONFIG SET: Using Redis 6.0 or newer, ACL configuration can be used to block the command. Using older versions, the rename-command configuration directive can be used to rename the command to a random string unknown to users, rendering it inaccessible. Please note that this workaround may have an additional impact on users or operational systems that expect CONFIG SET to behave in certain ways.

Record
UBUNTU-CVE-2021-21309
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L
Updated
2026-11-02
OSVMGASA-2021-0155 No score

Updated redis packages fix security vulnerability

It was discovered that there were a number of integer overflow issues in Redis. It is currently believed that the issues only affect 32-bit based systems (CVE-2021-21309).

Record
MGASA-2021-0155
Updated
2026-11-02
OSVMGASA-2021-0317 No score

Updated redis package fixes a security vulnerability

It was discovered that there were a number of integer overflow issues in Redis. It is currently believed that the issues only affect 32-bit based systems (CVE-2021-21309).

Record
MGASA-2021-0317
Updated
2026-11-02
OSVopenSUSE-SU-2021:0682-1 No score

Security update for redis

This update for redis fixes the following issues:

redis 6.0.13

  • CVE-2021-29477: Integer overflow in STRALGO LCS command (boo#1185729)
  • CVE-2021-29478: Integer overflow in COPY command for large intsets (boo#1185730)
  • Cluster: Skip unnecessary check which may prevent failure detection
  • Fix performance regression in BRPOP on Redis 6.0
  • Fix edge-case when a module client is unblocked

redis 6.0.12:

  • Fix compilation error on non-glibc systems if jemalloc is not used

redis 6.0.11:

  • CVE-2021-21309: Avoid 32-bit overflows when proto-max-bulk-len is set high (boo#1182657)
  • Fix handling of threaded IO and CLIENT PAUSE (failover), could lead to data loss or a crash
  • Fix the selection of a random element from large hash tables
  • Fix broken protocol in client tracking tracking-redir-broken message
  • XINFO able to access expired keys on a replica
  • Fix broken protocol in redis-benchmark when used with -a or --dbnum
  • Avoid assertions (on older kernels) when testing arm64 CoW bug
  • CONFIG REWRITE should honor umask settings
  • Fix firstkey,lastkey,step in COMMAND command for some commands
  • RM_ZsetRem: Delete key if empty, the bug could leave empty zset keys

redis 6.0.10:

Command behavior changes:

  • SWAPDB invalidates WATCHed keys (#8239)
  • SORT command behaves differently when used on a writable replica (#8283)
  • EXISTS should not alter LRU (#8016) In Redis 5.0 and 6.0 it would have touched the LRU/LFU of the key.
  • OBJECT should not reveal logically expired keys (#8016) Will now behave the same TYPE or any other non-DEBUG command.
  • GEORADIUS[BYMEMBER] can fail with -OOM if Redis is over the memory limit (#8107)

Other behavior changes:

  • Sentinel: Fix missing updates to the config file after SENTINEL SET command (#8229)
  • CONFIG REWRITE is atomic and safer, but requires write access to the config file's folder (#7824, #8051) This change was already present in 6.0.9, but was missing from the release notes.

Bug fixes with compatibility implications (bugs introduced in Redis 6.0):

  • Fix RDB CRC64 checksum on big-endian systems (#8270) If you're using big-endian please consider the compatibility implications with RESTORE, replication and persistence.
  • Fix wrong order of key/value in Lua's map response (#8266) If your scripts use redis.setresp() or return a map (new in Redis 6.0), please consider the implications.

Bug fixes:

  • Fix an issue where a forked process deletes the parent's pidfile (#8231)
  • Fix crashes when enabling io-threads-do-reads (#8230)
  • Fix a crash in redis-cli after executing cluster backup (#8267)
  • Handle output buffer limits for module blocked clients (#8141) Could result in a module sending reply to a blocked client to go beyond the limit.
  • Fix setproctitle related crashes. (#8150, #8088) Caused various crashes on startup, mainly on Apple M1 chips or under instrumentation.
  • Backup/restore cluster mode keys to slots map for repl-diskless-load=swapdb (#8108) In cluster mode with repl-diskless-load, when loading failed, slot map wouldn't have been restored.
  • Fix oom-score-adj-values range, and bug when used in config file (#8046) Enabling setting this in the config file in a line after enabling it, would have been buggy.
  • Reset average ttl when empty databases (#8106) Just causing misleading metric in INFO
  • Disable rehash when Redis has child process (#8007) This could have caused excessive CoW during BGSAVE, replication or AOFRW.
  • Further improved ACL algorithm for picking categories (#7966) Output of ACL GETUSER is now more similar to the one provided by ACL SETUSER.
  • Fix bug with module GIL being released prematurely (#8061) Could in theory (and rarely) cause multi-threaded modules to corrupt memory.
  • Reduce effect of client tracking causing feedback loop in key eviction (#8100)
  • Fix cluster access to unaligned memory (SIGBUS on old ARM) (#7958)
  • Fix saving of strings larger than 2GB into RDB files (#8306)

Additional improvements:

  • Avoid…
Record
openSUSE-SU-2021:0682-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11299-1 No score

redis-6.2.5-1.2 on GA media

These are all security issues fixed in the redis-6.2.5-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11299-1
Updated
2026-11-02
OSVSUSE-SU-2021:1652-1 No score

Security update for redis

This update for redis fixes the following issues:

redis was updated to 6.0.13:

  • CVE-2021-29477: Integer overflow in STRALGO LCS command (bsc#1185729)
  • CVE-2021-29478: Integer overflow in COPY command for large intsets (bsc#1185730)
  • Cluster: Skip unnecessary check which may prevent failure detection
  • Fix performance regression in BRPOP on Redis 6.0
  • Fix edge-case when a module client is unblocked

redis 6.0.12:

  • Fix compilation error on non-glibc systems if jemalloc is not used

redis 6.0.11:

  • CVE-2021-21309: Avoid 32-bit overflows when proto-max-bulk-len is set high (bsc#1182657)
  • Fix handling of threaded IO and CLIENT PAUSE (failover), could lead to data loss or a crash
  • Fix the selection of a random element from large hash tables
  • Fix broken protocol in client tracking tracking-redir-broken message
  • XINFO able to access expired keys on a replica
  • Fix broken protocol in redis-benchmark when used with -a or --dbnum
  • Avoid assertions (on older kernels) when testing arm64 CoW bug
  • CONFIG REWRITE should honor umask settings
  • Fix firstkey,lastkey,step in COMMAND command for some commands
  • RM_ZsetRem: Delete key if empty, the bug could leave empty zset keys
Record
SUSE-SU-2021:1652-1
Updated
2026-11-02
OSVUSN-5221-1 No score

redis vulnerabilities

It was discovered that Redis incorrectly handled certain specially crafted Lua scripts. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2021-32626)

It was discovered that Redis incorrectly handled some malformed requests when using Redis Lua Debugger. A remote attacker could possibly use this issue to cause a denial of service or other unspecified impact. This issue only affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2021-32672)

It was discovered that Redis incorrectly handled certain Redis Standard Protocol (RESP) requests. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2021-32675)

It was discovered that Redis incorrectly handled some configuration parameters with specially crafted network payloads. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. Vulnerabilities CVE-2021-32627 and CVE-2021-41099 only affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2021-32627, CVE-2021-32628, CVE-2021-32687, CVE-2021-41099).

It was discovered that Redis incorrectly handled memory when processing certain input in 32-bit systems. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. One vulnerability (CVE-2021-32761) only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM and Ubuntu 18.04 ESM and another vulnerability (CVE-2021-21309) only affected Ubuntu 18.04 ESM. (CVE-2021-32761, CVE-2021-21309).

Record
USN-5221-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
redis
Alpine:v3.10
 4.0 up to 5.0.11-r0
5.0.11-r0
redis
Alpine:v3.11
 4.0 up to 5.0.11-r0
5.0.11-r0
redis
Alpine:v3.12
 4.0 up to 5.0.11-r0
5.0.11-r0
redis
Alpine:v3.13
 4.0 up to 6.0.11-r0
6.0.11-r0
redis
Alpine:v3.14
 4.0 up to 6.2.0-r0
6.2.0-r0
redis
Alpine:v3.15
 4.0 up to 6.2.0-r0
6.2.0-r0
redis
Alpine:v3.16
 4.0 up to 6.2.0-r0
6.2.0-r0
redis
Alpine:v3.17
 4.0 up to 6.2.0-r0
6.2.0-r0
redis
Alpine:v3.18
 4.0 up to 6.2.0-r0
6.2.0-r0
redis
Alpine:v3.19
 4.0 up to 6.2.0-r0
6.2.0-r0
Show 23 moreShow less
Affected packages
PackageAffectedFixed
redis
Alpine:v3.20
 4.0 up to 6.2.0-r0
6.2.0-r0
redis
Alpine:v3.21
 4.0 up to 6.2.0-r0
6.2.0-r0
redis
Alpine:v3.22
 4.0 up to 6.2.0-r0
6.2.0-r0
redis
Alpine:v3.23
 4.0 up to 6.2.0-r0
6.2.0-r0
redis
Alpine:v3.24
 4.0 up to 6.2.0-r0
6.2.0-r0
redis
Azure Linux:2
 before 5.0.5-7
5.0.5-7
redis
Debian:12
 before 5:6.0.11-1
5:6.0.11-1
redis
Debian:13
 before 5:6.0.11-1
5:6.0.11-1
redis
Debian:14
 before 5:6.0.11-1
5:6.0.11-1
redis
Debian:9
 before 3:3.2.6-3+deb9u4, plus listed versions
3:3.2.6-13:3.2.6-23:3.2.6-33:3.2.6-3+deb9u13:3.2.6-3+deb9u23:3.2.6-3+deb9u3
3:3.2.6-3+deb9u4
redis
Mageia:8
 before 6.0.11-1.mga8
6.0.11-1.mga8
redis
Mageia:7
 before 5.0.9-1.1.mga7
5.0.9-1.1.mga7
redis
openEuler:20.03-LTS
 before 4.0.11-13.oe1
4.0.11-13.oe1
redis
openEuler:20.03-LTS-SP1
 before 4.0.11-13.oe1
4.0.11-13.oe1
redis
SUSE:Linux Enterprise Module for Server Applications 15 SP2
From an advisory covering 3 CVEs
 before 6.0.13-1.10.1
6.0.13-1.10.1
redis
SUSE:Linux Enterprise Module for Server Applications 15 SP3
From an advisory covering 3 CVEs
 before 6.0.13-1.10.1
6.0.13-1.10.1
redis
Ubuntu:Pro:18.04:LTS
 before 5:4.0.9-1ubuntu0.2+esm3, plus listed versions
4:4.0.1-74:4.0.2-64:4.0.2-95:4.0.5-15:4.0.6-1
Show 8 moreShow less
5:4.0.6-25:4.0.7-15:4.0.8-15:4.0.8-25:4.0.9-15:4.0.9-1ubuntu0.15:4.0.9-1ubuntu0.25:4.0.9-1ubuntu0.2+esm2
5:4.0.9-1ubuntu0.2+esm3
redis
Ubuntu:Pro:14.04:LTS
From an advisory covering 9 CVEs
 before 2:2.8.4-2ubuntu0.2+esm2, plus listed versions
2:2.6.13-12:2.6.16-32:2.8.0-12:2.8.2-12:2.8.4-22:2.8.4-2ubuntu0.22:2.8.4-2ubuntu0.2+esm1
2:2.8.4-2ubuntu0.2+esm2
redis
Ubuntu:Pro:16.04:LTS
From an advisory covering 9 CVEs
 before 2:3.0.6-1ubuntu0.4+esm1, plus listed versions
2:3.0.3-32:3.0.5-12:3.0.5-22:3.0.5-32:3.0.5-4
Show 4 moreShow less
2:3.0.6-12:3.0.6-1ubuntu0.22:3.0.6-1ubuntu0.32:3.0.6-1ubuntu0.4
2:3.0.6-1ubuntu0.4+esm1
redis
Ubuntu:Pro:18.04:LTS
From an advisory covering 9 CVEs
 before 5:4.0.9-1ubuntu0.2+esm3, plus listed versions
4:4.0.1-74:4.0.2-64:4.0.2-95:4.0.5-15:4.0.6-1
Show 8 moreShow less
5:4.0.6-25:4.0.7-15:4.0.8-15:4.0.8-25:4.0.9-15:4.0.9-1ubuntu0.15:4.0.9-1ubuntu0.25:4.0.9-1ubuntu0.2+esm2
5:4.0.9-1ubuntu0.2+esm3
redis
Ubuntu:Pro:20.04:LTS
From an advisory covering 9 CVEs
 before 5:5.0.7-2ubuntu0.1+esm1, plus listed versions
5:5.0.5-2build15:5.0.6-15:5.0.7-15:5.0.7-25:5.0.7-2ubuntu0.1~esm15:5.0.7-2ubuntu0.1
5:5.0.7-2ubuntu0.1+esm1
redis
openSUSE:Leap 15.2
From an advisory covering 3 CVEs
 before 6.0.13-lp152.2.3.1
6.0.13-lp152.2.3.1
redis
openSUSE:Tumbleweed
From an advisory covering 9 CVEs
 before 6.2.5-1.2
6.2.5-1.2

History

History
RecordedChangedSources
affected, facts
affectedOSV
aliasesEUVD
first indexedCVE List, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-21309 is a medium vulnerability (CVSS 5.4) in Redis, published February 25, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.79%, the 91st percentile. Fixed in redis 5.0.11-r0.

References

Show 34 moreShow less
This page doesn't list everything

Left out here: the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open