Every CVE Search/ Get API key

CVE-2021-31294

Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by...

5.9 MediumFix available

Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by sending a non-administrative command (specifically, a SET command). NOTE: this was fixed for Redis 6.2.x and 7.x in 2021. Versions before 6.2 were not intended to have safety guarantees related to this.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.31%Up 1.3 points since Jul 16, 2023
90%50%10%1%

What each source reports

NVD Score used 5.9

Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by sending a non-administrative command (specifically, a SET command). NOTE: this was fixed for Redis 6.2.x and 7.x in 2021. Versions before 6.2 were not intended to have safety guarantees related to this.

Record
CVE-2021-31294
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-617
Updated
2026-11-02
CVE List No score

Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by sending a non-administrative command (specifically, a SET command). NOTE: this was fixed for Redis 6.2.x and 7.x in 2021. Versions before 6.2 were not intended to have safety guarantees related to this.

Record
CVE-2021-31294
Updated
2026-11-02
EUVDEUVD-2021-18204 No score

Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by sending a non-administrative command (specifically, a SET command). NOTE: this was fixed for Redis 6.2.x and 7.x in 2021. Versions before 6.2 were not intended to have safety guarantees related to this.

Record
EUVD-2021-18204
Updated
2026-11-03
GitHub AdvisoriesGHSA-g2jg-2qcv-q3h9 7.5

Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by...

Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by sending a non-administrative command (specifically, a SET command). NOTE: this was fixed for Redis 6.2.x and 7.x in 2021. Versions before 6.2 were not intended to have safety guarantees related to this.

Record
GHSA-g2jg-2qcv-q3h9
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-617
Updated
2026-11-02
OSV 5.9

Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by sending a non-administrative command (specifically, a SET command). NOTE: this was fixed for Redis 6.2.x and 7.x in 2021. Versions before 6.2 were not intended to have safety guarantees related to this.

Record
CVE-2021-31294
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2021-31294 5.9

Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by sending a non-administrative command (specifically, a SET command). NOTE: this was fixed for Redis 6.2.x and 7.x in 2021. Versions before 6.2 were not intended to have safety guarantees related to this.

Record
DEBIAN-CVE-2021-31294
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVPYSEC-2023-312 5.9

Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by sending a non-administrative command (specifically, a SET command). NOTE: this was fixed for Redis 6.2.x and 7.x in 2021. Versions before 6.2 were not intended to have safety guarantees related to this.

Record
PYSEC-2023-312
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-31294 5.9

Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by sending a non-administrative command (specifically, a SET command). NOTE: this was fixed for Redis 6.2.x and 7.x in 2021. Versions before 6.2 were not intended to have safety guarantees related to this.

Record
UBUNTU-CVE-2021-31294
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBIT-keydb-2021-31294 No score

Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by sending a non-administrative command (specifically, a SET command). NOTE: this was fixed for Redis 6.2.x and 7.x in 2021. Versions before 6.2 were not intended to have safety guarantees related to this.

Record
BIT-keydb-2021-31294
Updated
2026-11-02
OSVBIT-redis-2021-31294 No score

Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by sending a non-administrative command (specifically, a SET command). NOTE: this was fixed for Redis 6.2.x and 7.x in 2021. Versions before 6.2 were not intended to have safety guarantees related to this.

Record
BIT-redis-2021-31294
Updated
2026-11-02
OSVBIT-valkey-2021-31294 No score

Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by sending a non-administrative command (specifically, a SET command). NOTE: this was fixed for Redis 6.2.x and 7.x in 2021. Versions before 6.2 were not intended to have safety guarantees related to this.

Record
BIT-valkey-2021-31294
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
keydb
Bitnami
 before 6.2.0
6.2.0
redis
Bitnami
 before 6.2.0
6.2.0
valkey
Bitnami
 before 6.2.0
6.2.0
redis
Debian:12
 before 5:7.0.1-4
5:7.0.1-4
redis
Debian:13
 before 5:7.0.1-4
5:7.0.1-4
redis
Debian:14
 before 5:7.0.1-4
5:7.0.1-4
redis
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
2:2.6.13-12:2.6.16-32:2.8.0-12:2.8.2-12:2.8.4-2
Show 6 moreShow less
2:2.8.4-2ubuntu0.22:2.8.4-2ubuntu0.2+esm12:2.8.4-2ubuntu0.2+esm22:2.8.4-2ubuntu0.2+esm32:2.8.4-2ubuntu0.2+esm42:2.8.4-2ubuntu0.2+esm5
 None known
redis
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2:3.0.3-32:3.0.5-12:3.0.5-22:3.0.5-32:3.0.5-4
Show 9 moreShow less
2:3.0.6-12:3.0.6-1ubuntu0.22:3.0.6-1ubuntu0.32:3.0.6-1ubuntu0.42:3.0.6-1ubuntu0.4+esm12:3.0.6-1ubuntu0.4+esm22:3.0.6-1ubuntu0.4+esm32:3.0.6-1ubuntu0.4+esm42:3.0.6-1ubuntu0.4+esm5
 None known
redis
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
4:4.0.1-74:4.0.2-64:4.0.2-95:4.0.5-15:4.0.6-1
Show 13 moreShow less
5:4.0.6-25:4.0.7-15:4.0.8-15:4.0.8-25:4.0.9-15:4.0.9-1ubuntu0.15:4.0.9-1ubuntu0.25:4.0.9-1ubuntu0.2+esm25:4.0.9-1ubuntu0.2+esm35:4.0.9-1ubuntu0.2+esm45:4.0.9-1ubuntu0.2+esm55:4.0.9-1ubuntu0.2+esm65:4.0.9-1ubuntu0.2+esm7
 None known
redis
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
5:5.0.5-2build15:5.0.6-15:5.0.7-15:5.0.7-25:5.0.7-2ubuntu0.1~esm1
Show 5 moreShow less
5:5.0.7-2ubuntu0.15:5.0.7-2ubuntu0.1+esm15:5.0.7-2ubuntu0.1+esm25:5.0.7-2ubuntu0.1+esm35:5.0.7-2ubuntu0.1+esm4
 None known
redis
Ubuntu:22.04:LTS
 All versions, plus listed versions
5:6.0.15-15:6.0.16-15:6.0.16-1build15:6.0.16-1ubuntu15:6.0.16-1ubuntu1.15:6.0.16-1ubuntu1.2
 None known

History

History
RecordedChangedSources
affected
affected, aliasesEUVD
first indexedOSV
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-31294 is a medium vulnerability (CVSS 5.9) in Redis, published July 15, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.31%, the 70th percentile. Fixed in keydb 6.2.0.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open