Every CVE Search/ Get API key

CVE-2021-32625

Redis vulnerability in STRALGO LCS on 32-bit systems

7.5 HighFix available

Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer, could be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. This is a result of an incomplete fix by CVE-2021-29477. The problem is fixed in version 6.2.4 and 6.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to use ACL configuration to prevent clients from using the STRALGO LCS command. On 64 bit systems which have the fixes of CVE-2021-29477 (6.2.3 or 6.0.13), it is sufficient to make sure that the proto-max-bulk-len config parameter is smaller than 2GB (default is 512MB).

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

4.14%Up 2.3 points since Jun 3, 2021
90%50%10%1%

What each source reports

CVE List Score used 7.5

Redis vulnerability in STRALGO LCS on 32-bit systems

Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer, could be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. This is a result of an incomplete fix by CVE-2021-29477. The problem is fixed in version 6.2.4 and 6.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to use ACL configuration to prevent clients from using the STRALGO LCS command. On 64 bit systems which have the fixes of CVE-2021-29477 (6.2.3 or 6.0.13), it is sufficient to make sure that the proto-max-bulk-len config parameter is smaller than 2GB (default is 512MB).

Record
CVE-2021-32625
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-680
Updated
2026-11-02
EUVDEUVD-2021-19456 7.5

Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer, could be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. This is a result of an incomplete fix by CVE-2021-29477. The problem is fixed in version 6.2.4 and 6.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to use ACL configuration to prevent clients from using the STRALGO LCS command. On 64 bit systems which have the fixes of CVE-2021-29477 (6.2.3 or 6.0.13), it is sufficient to make sure that the proto-max-bulk-len config parameter is smaller than 2GB (default is 512MB).

Record
EUVD-2021-19456
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
NVD 7.5

Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer, could be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. This is a result of an incomplete fix by CVE-2021-29477. The problem is fixed in version 6.2.4 and 6.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to use ACL configuration to prevent clients from using the STRALGO LCS command. On 64 bit systems which have the fixes of CVE-2021-29477 (6.2.3 or 6.0.13), it is sufficient to make sure that the proto-max-bulk-len config parameter is smaller than 2GB (default is 512MB).

Record
CVE-2021-32625
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness
CWE-680, CWE-190
Updated
2026-11-02
OSVALPINE-CVE-2021-32625 8.8

Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer, could be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. This is a result of an incomplete fix by CVE-2021-29477. The problem is fixed in version 6.2.4 and 6.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to use ACL configuration to prevent clients from using the STRALGO LCS command. On 64 bit systems which have the fixes of CVE-2021-29477 (6.2.3 or 6.0.13), it is sufficient to make sure that the proto-max-bulk-len config parameter is smaller than 2GB (default is 512MB).

Record
ALPINE-CVE-2021-32625
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVBELL-CVE-2021-32625 8.8

CVE-2021-32625 does not affect BellSoft software

Record
BELL-CVE-2021-32625
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 8.8

Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer, could be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. This is a result of an incomplete fix by CVE-2021-29477. The problem is fixed in version 6.2.4 and 6.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to use ACL configuration to prevent clients from using the STRALGO LCS command. On 64 bit systems which have the fixes of CVE-2021-29477 (6.2.3 or 6.0.13), it is sufficient to make sure that the proto-max-bulk-len config parameter is smaller than 2GB (default is 512MB).

Record
CVE-2021-32625
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2021-32625 8.8

Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer, could be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. This is a result of an incomplete fix by CVE-2021-29477. The problem is fixed in version 6.2.4 and 6.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to use ACL configuration to prevent clients from using the STRALGO LCS command. On 64 bit systems which have the fixes of CVE-2021-29477 (6.2.3 or 6.0.13), it is sufficient to make sure that the proto-max-bulk-len config parameter is smaller than 2GB (default is 512MB).

Record
DEBIAN-CVE-2021-32625
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-32625 7.5

Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer, could be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. This is a result of an incomplete fix by CVE-2021-29477. The problem is fixed in version 6.2.4 and 6.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to use ACL configuration to prevent clients from using the STRALGO LCS command. On 64 bit systems which have the fixes of CVE-2021-29477 (6.2.3 or 6.0.13), it is sufficient to make sure that the proto-max-bulk-len config parameter is smaller than 2GB (default is 512MB).

Record
UBUNTU-CVE-2021-32625
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2021:0841-1 No score

Security update for redis

This update for redis fixes the following issues:

redis was updated to 6.0.14:

  • CVE-2021-32625: An integer overflow bug could be exploited by using the STRALGO LCS command to cause remote remote code execution (boo#1186722)
  • Fix crash in UNLINK on a stream key with deleted consumer groups
  • SINTERSTORE: Add missing keyspace del event when none of the sources exist
Record
openSUSE-SU-2021:0841-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:2294-1 No score

Security update for redis

This update for redis fixes the following issues:

  • Upgrade to 6.0.14
  • CVE-2021-32625: An integer overflow bug could be exploited by using the STRALGO LCS command to cause remote remote code execution (bsc#1186722)
  • Fix crash in UNLINK on a stream key with deleted consumer groups
  • SINTERSTORE: Add missing keyspace del event when none of the sources exist
Record
openSUSE-SU-2021:2294-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11299-1 No score

redis-6.2.5-1.2 on GA media

These are all security issues fixed in the redis-6.2.5-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11299-1
Updated
2026-11-02
OSVSUSE-SU-2021:2294-1 No score

Security update for redis

This update for redis fixes the following issues:

  • Upgrade to 6.0.14
  • CVE-2021-32625: An integer overflow bug could be exploited by using the STRALGO LCS command to cause remote remote code execution (bsc#1186722)
  • Fix crash in UNLINK on a stream key with deleted consumer groups
  • SINTERSTORE: Add missing keyspace del event when none of the sources exist
Record
SUSE-SU-2021:2294-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
redis
Alpine:v3.13
 6.0.0 up to 6.0.14-r0
6.0.14-r0
redis
Alpine:v3.14
 6.0.0 up to 6.2.4-r0
6.2.4-r0
redis
Alpine:v3.15
 6.0.0 up to 6.2.4-r0
6.2.4-r0
redis
Alpine:v3.16
 6.0.0 up to 6.2.4-r0
6.2.4-r0
redis
Alpine:v3.17
 6.0.0 up to 6.2.4-r0
6.2.4-r0
redis
Alpine:v3.18
 6.0.0 up to 6.2.4-r0
6.2.4-r0
redis
Alpine:v3.19
 6.0.0 up to 6.2.4-r0
6.2.4-r0
redis
Alpine:v3.20
 6.0.0 up to 6.2.4-r0
6.2.4-r0
redis
Alpine:v3.21
 6.0.0 up to 6.2.4-r0
6.2.4-r0
redis
Alpine:v3.22
 6.0.0 up to 6.2.4-r0
6.2.4-r0
Show 12 moreShow less
Affected packages
PackageAffectedFixed
redis
Alpine:v3.23
 6.0.0 up to 6.2.4-r0
6.2.4-r0
redis
Alpine:v3.24
 6.0.0 up to 6.2.4-r0
6.2.4-r0
redis
Debian:12
 before 5:6.0.14-1
5:6.0.14-1
redis
Debian:13
 before 5:6.0.14-1
5:6.0.14-1
redis
Debian:14
 before 5:6.0.14-1
5:6.0.14-1
redis
SUSE:Linux Enterprise Module for Server Applications 15 SP2
 before 6.0.14-6.5.1
6.0.14-6.5.1
redis
SUSE:Linux Enterprise Module for Server Applications 15 SP3
 before 6.0.14-6.5.1
6.0.14-6.5.1
redis
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
2:2.6.13-12:2.6.16-32:2.8.0-12:2.8.2-12:2.8.4-2
Show 6 moreShow less
2:2.8.4-2ubuntu0.22:2.8.4-2ubuntu0.2+esm12:2.8.4-2ubuntu0.2+esm22:2.8.4-2ubuntu0.2+esm32:2.8.4-2ubuntu0.2+esm42:2.8.4-2ubuntu0.2+esm5
 None known
redis
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2:3.0.3-32:3.0.5-12:3.0.5-22:3.0.5-32:3.0.5-4
Show 9 moreShow less
2:3.0.6-12:3.0.6-1ubuntu0.22:3.0.6-1ubuntu0.32:3.0.6-1ubuntu0.42:3.0.6-1ubuntu0.4+esm12:3.0.6-1ubuntu0.4+esm22:3.0.6-1ubuntu0.4+esm32:3.0.6-1ubuntu0.4+esm42:3.0.6-1ubuntu0.4+esm5
 None known
redis
openSUSE:Leap 15.2
 before 6.0.14-lp152.2.6.1
6.0.14-lp152.2.6.1
redis
openSUSE:Leap 15.3
 before 6.0.14-6.5.1
6.0.14-6.5.1
redis
openSUSE:Tumbleweed
From an advisory covering 9 CVEs
 before 6.2.5-1.2
6.2.5-1.2

History

History
RecordedChangedSources
affected, facts
affectedOSV
aliasesEUVD
first indexedCVE List, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-32625 is a high vulnerability (CVSS 7.5) in Redis, published June 2, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.14%, the 90th percentile. Fixed in redis 6.0.14-r0.

References

Show 19 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open