CVE-2022-31144
Potential heap overflow in Redis
Redis is an in-memory database that persists on disk. A specially crafted XAUTOCLAIM command on a stream key in a specific state may result with heap overflow, and potentially remote code execution. This problem affects versions on the 7.x branch prior to 7.0.4. The patch is released in version 7.0.4.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Potential heap overflow in Redis
Redis is an in-memory database that persists on disk. A specially crafted XAUTOCLAIM command on a stream key in a specific state may result with heap overflow, and potentially remote code execution. This problem affects versions on the 7.x branch prior to 7.0.4. The patch is released in version 7.0.4.
- Record
CVE-2022-31144- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
EUVDEUVD-2022-52768
Redis is an in-memory database that persists on disk. A specially crafted XAUTOCLAIM command on a stream key in a specific state may result with heap overflow, and potentially remote code execution. This problem affects versions on the 7.x branch prior to 7.0.4. The patch is released in version 7.0.4.
- Record
EUVD-2022-52768- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
NVD
Redis is an in-memory database that persists on disk. A specially crafted XAUTOCLAIM command on a stream key in a specific state may result with heap overflow, and potentially remote code execution. This problem affects versions on the 7.x branch prior to 7.0.4. The patch is released in version 7.0.4.
- Record
CVE-2022-31144- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-122, CWE-787
- Updated
- 2026-11-02
OSVALPINE-CVE-2022-31144
Redis is an in-memory database that persists on disk. A specially crafted XAUTOCLAIM command on a stream key in a specific state may result with heap overflow, and potentially remote code execution. This problem affects versions on the 7.x branch prior to 7.0.4. The patch is released in version 7.0.4.
- Record
ALPINE-CVE-2022-31144- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVBELL-CVE-2022-31144
CVE-2022-31144 does not affect BellSoft software
- Record
BELL-CVE-2022-31144- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
Potential heap overflow in Redis
Redis is an in-memory database that persists on disk. A specially crafted XAUTOCLAIM command on a stream key in a specific state may result with heap overflow, and potentially remote code execution. This problem affects versions on the 7.x branch prior to 7.0.4. The patch is released in version 7.0.4.
- Record
CVE-2022-31144- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2022-31144
Redis is an in-memory database that persists on disk. A specially crafted XAUTOCLAIM command on a stream key in a specific state may result with heap overflow, and potentially remote code execution. This problem affects versions on the 7.x branch prior to 7.0.4. The patch is released in version 7.0.4.
- Record
DEBIAN-CVE-2022-31144- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVUBUNTU-CVE-2022-31144
Redis is an in-memory database that persists on disk. A specially crafted XAUTOCLAIM command on a stream key in a specific state may result with heap overflow, and potentially remote code execution. This problem affects versions on the 7.x branch prior to 7.0.4. The patch is released in version 7.0.4.
- Record
UBUNTU-CVE-2022-31144- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVAZL-10315 No score
CVE-2022-31144 for package redis is not applicable
This CVE either no longer is or was never applicable.
- Record
AZL-10315- Updated
- 2026-11-02
OSVBIT-keydb-2022-31144 No score
Potential heap overflow in Redis
Redis is an in-memory database that persists on disk. A specially crafted XAUTOCLAIM command on a stream key in a specific state may result with heap overflow, and potentially remote code execution. This problem affects versions on the 7.x branch prior to 7.0.4. The patch is released in version 7.0.4.
- Record
BIT-keydb-2022-31144- Updated
- 2026-11-02
OSVBIT-redis-2022-31144 No score
Potential heap overflow in Redis
Redis is an in-memory database that persists on disk. A specially crafted XAUTOCLAIM command on a stream key in a specific state may result with heap overflow, and potentially remote code execution. This problem affects versions on the 7.x branch prior to 7.0.4. The patch is released in version 7.0.4.
- Record
BIT-redis-2022-31144- Updated
- 2026-11-02
OSVBIT-valkey-2022-31144 No score
Potential heap overflow in Redis
Redis is an in-memory database that persists on disk. A specially crafted XAUTOCLAIM command on a stream key in a specific state may result with heap overflow, and potentially remote code execution. This problem affects versions on the 7.x branch prior to 7.0.4. The patch is released in version 7.0.4.
- Record
BIT-valkey-2022-31144- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12217-1 No score
redis-7.0.4-1.1 on GA media
These are all security issues fixed in the redis-7.0.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12217-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
redisAlpine:v3.16 |
7.0 up to 7.0.4-r0 | 7.0.4-r0 |
redisAlpine:v3.17 |
7.0 up to 7.0.4-r0 | 7.0.4-r0 |
redisAlpine:v3.18 |
7.0 up to 7.0.4-r0 | 7.0.4-r0 |
redisAlpine:v3.19 |
7.0 up to 7.0.4-r0 | 7.0.4-r0 |
redisAlpine:v3.20 |
7.0 up to 7.0.4-r0 | 7.0.4-r0 |
redisAlpine:v3.21 |
7.0 up to 7.0.4-r0 | 7.0.4-r0 |
redisAlpine:v3.22 |
7.0 up to 7.0.4-r0 | 7.0.4-r0 |
redisAlpine:v3.23 |
7.0 up to 7.0.4-r0 | 7.0.4-r0 |
redisAlpine:v3.24 |
7.0 up to 7.0.4-r0 | 7.0.4-r0 |
keydbBitnami |
7.0.0 up to 7.0.4 | 7.0.4 |
Show 6 moreShow less
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | SpiralBL0CK/CVE-2022-31144 | 2023-02-03 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| affected | ||
| first indexed | CVE List, EUVD, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-31144 is a high vulnerability (CVSS 7.0) in Redis, published July 19, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.24%, the 88th percentile. Fixed in redis 7.0.4-r0.