{"id":"CVE-2021-21309","aliases":["ALPINE-CVE-2021-21309","AZL-6843","BELL-CVE-2021-21309","DEBIAN-CVE-2021-21309","DLA-2576-1","EUVD-2021-8663","GHSA-hgj8-vff2-7cjf","MGASA-2021-0155","MGASA-2021-0317","OESA-2021-1093","SUSE-SU-2021:1652-1","UBUNTU-CVE-2021-21309","USN-5221-1","openSUSE-SU-2021:0682-1","openSUSE-SU-2024:11299-1"],"status":"published","title":"Integer overflow on 32-bit systems","description":"Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and potentially result with remote code execution. Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the limit is significantly increased, receiving a large request from a client may trigger several integer overflow scenarios, which would result with buffer overflow and heap corruption. We believe this could in certain conditions be exploited for remote code execution. By default, authenticated Redis users have access to all configuration parameters and can therefore use the “CONFIG SET proto-max-bulk-len” to change the safe default, making the system vulnerable. **This problem only affects 32-bit Redis (on a 32-bit system, or as a 32-bit executable running on a 64-bit system).** The problem is fixed in version 6.2, and the fix is back ported to 6.0.11 and 5.0.11. Make sure you use one of these versions if you are running 32-bit Redis. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent clients from directly executing `CONFIG SET`: Using Redis 6.0 or newer, ACL configuration can be used to block the command. Using older versions, the `rename-command` configuration directive can be used to rename the command to a random string unknown to users, rendering it inaccessible. Please note that this workaround may have an additional impact on users or operational systems that expect `CONFIG SET` to behave in certain ways.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0479,"percentile":0.9206,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2021-02-25T00:00:00Z","modified":"2026-11-03T06:32:27Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"redis","fixed_in":["5.0.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"redis","fixed_in":["5.0.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"redis","fixed_in":["5.0.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"redis","fixed_in":["6.0.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"redis","fixed_in":["6.2.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"redis","fixed_in":["6.2.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"redis","fixed_in":["6.2.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"redis","fixed_in":["6.2.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"redis","fixed_in":["6.2.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"redis","fixed_in":["6.2.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"redis","fixed_in":["6.2.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"redis","fixed_in":["6.2.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"redis","fixed_in":["6.2.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"redis","fixed_in":["6.2.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"redis","fixed_in":["6.2.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"redis","fixed_in":["5.0.5-7"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"redis","fixed_in":["5:6.0.11-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"redis","fixed_in":["5:6.0.11-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"redis","fixed_in":["5:6.0.11-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"redis","fixed_in":["3:3.2.6-3+deb9u4"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"redis","fixed_in":["6.0.11-1.mga8"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"redis","fixed_in":["5.0.9-1.1.mga7"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS","package":"redis","fixed_in":["4.0.11-13.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"redis","fixed_in":["4.0.11-13.oe1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"redis","fixed_in":["5:4.0.9-1ubuntu0.2+esm3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0"},{"fixed":"5.0.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0"},{"fixed":"5.0.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0"},{"fixed":"5.0.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0"},{"fixed":"6.0.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0"},{"fixed":"6.2.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0"},{"fixed":"6.2.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0"},{"fixed":"6.2.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0"},{"fixed":"6.2.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0"},{"fixed":"6.2.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0"},{"fixed":"6.2.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0"},{"fixed":"6.2.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0"},{"fixed":"6.2.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0"},{"fixed":"6.2.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0"},{"fixed":"6.2.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0"},{"fixed":"6.2.0-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5-7"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:6.0.11-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:6.0.11-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:6.0.11-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:3.2.6-3+deb9u4"}]}],"versions":["3:3.2.6-1","3:3.2.6-2","3:3.2.6-3","3:3.2.6-3+deb9u1","3:3.2.6-3+deb9u2","3:3.2.6-3+deb9u3"]},{"source":"osv","ecosystem":"Mageia:8","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.11-1.mga8"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.9-1.1.mga7"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.11-13.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.11-13.oe1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP2","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.13-1.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.13-1.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:4.0.9-1ubuntu0.2+esm3"}]}],"versions":["4:4.0.1-7","4:4.0.2-6","4:4.0.2-9","5:4.0.5-1","5:4.0.6-1","5:4.0.6-2","5:4.0.7-1","5:4.0.8-1","5:4.0.8-2","5:4.0.9-1","5:4.0.9-1ubuntu0.1","5:4.0.9-1ubuntu0.2","5:4.0.9-1ubuntu0.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.8.4-2ubuntu0.2+esm2"}]}],"versions":["2:2.6.13-1","2:2.6.16-3","2:2.8.0-1","2:2.8.2-1","2:2.8.4-2","2:2.8.4-2ubuntu0.2","2:2.8.4-2ubuntu0.2+esm1"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.0.6-1ubuntu0.4+esm1"}]}],"versions":["2:3.0.3-3","2:3.0.5-1","2:3.0.5-2","2:3.0.5-3","2:3.0.5-4","2:3.0.6-1","2:3.0.6-1ubuntu0.2","2:3.0.6-1ubuntu0.3","2:3.0.6-1ubuntu0.4"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:4.0.9-1ubuntu0.2+esm3"}]}],"versions":["4:4.0.1-7","4:4.0.2-6","4:4.0.2-9","5:4.0.5-1","5:4.0.6-1","5:4.0.6-2","5:4.0.7-1","5:4.0.8-1","5:4.0.8-2","5:4.0.9-1","5:4.0.9-1ubuntu0.1","5:4.0.9-1ubuntu0.2","5:4.0.9-1ubuntu0.2+esm2"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.0.7-2ubuntu0.1+esm1"}]}],"versions":["5:5.0.5-2build1","5:5.0.6-1","5:5.0.7-1","5:5.0.7-2","5:5.0.7-2ubuntu0.1~esm1","5:5.0.7-2ubuntu0.1"],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.13-lp152.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.5-1.2"}]}],"bundled":9}],"products":[{"vendor":"redis","product":"redis"},{"vendor":"redislabs","product":"redis"}],"references":[{"url":"https://github.com/redis/redis/security/advisories/GHSA-hgj8-vff2-7cjf","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/redis/redis/commit/c992857618db99776917f10bf4f2345a5fdc78b0","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/redis/redis/pull/8522","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://security.gentoo.org/glsa/202103-02","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-21309","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21309","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-21309","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-21309","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0155.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28452","tags":["report"]},{"url":"https://www.debian.org/lts/security/2021/dla-2576","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2021-0317.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28492","tags":["report"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1093","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211652-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1182657","tags":["report"]},{"url":"https://bugzilla.suse.com/1185729","tags":["report"]},{"url":"https://bugzilla.suse.com/1185730","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29478","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-21309","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5221-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21309","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-32626","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-32627","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-32628","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-32672","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-32675","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-32687","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-32761","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-41099","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/Z32YY6DUIFNGIYRC6JPVBZ2WTPYN5SOY/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1178205","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32761","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-21309","title":"Integer overflow on 32-bit systems","description":"Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and potentially result with remote code execution. Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the limit is significantly increased, receiving a large request from a client may trigger several integer overflow scenarios, which would result with buffer overflow and heap corruption. We believe this could in certain conditions be exploited for remote code execution. By default, authenticated Redis users have access to all configuration parameters and can therefore use the “CONFIG SET proto-max-bulk-len” to change the safe default, making the system vulnerable. **This problem only affects 32-bit Redis (on a 32-bit system, or as a 32-bit executable running on a 64-bit system).** The problem is fixed in version 6.2, and the fix is back ported to 6.0.11 and 5.0.11. Make sure you use one of these versions if you are running 32-bit Redis. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent clients from directly executing `CONFIG SET`: Using Redis 6.0 or newer, ACL configuration can be used to block the command. Using older versions, the `rename-command` configuration directive can be used to rename the command to a random string unknown to users, rendering it inaccessible. Please note that this workaround may have an additional impact on users or operational systems that expect `CONFIG SET` to behave in certain ways.","status":"published","published":"2021-02-26T21:50:16Z","modified":"2024-08-03T18:09:15.32Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:33:00.488332Z"}],"euvd":[{"id":"EUVD-2021-8663","description":"Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and potentially result with remote code execution. Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the limit is significantly increased, receiving a large request from a client may trigger several integer overflow scenarios, which would result with buffer overflow and heap corruption. We believe this could in certain conditions be exploited for remote code execution. By default, authenticated Redis users have access to all configuration parameters and can therefore use the “CONFIG SET proto-max-bulk-len” to change the safe default, making the system vulnerable. **This problem only affects 32-bit Redis (on a 32-bit system, or as a 32-bit executable running on a 64-bit system).** The problem is fixed in version 6.2, and the fix is back ported to 6.0.11 and 5.0.11. Make sure you use one of these versions if you are running 32-bit Redis. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent clients from directly executing `CONFIG SET`: Using Redis 6.0 or newer, ACL configuration can be used to block the command. Using older versions, the `rename-command` configuration directive can be used to rename the command to a random string unknown to users, rendering it inaccessible. Please note that this workaround may have an additional impact on users or operational systems that expect `CONFIG SET` to behave in certain ways.","status":"published","published":"2021-02-26T21:50:16Z","modified":"2024-08-03T18:09:15Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T03:25:06.347262Z"}],"nvd":[{"id":"CVE-2021-21309","description":"Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and potentially result with remote code execution. Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the limit is significantly increased, receiving a large request from a client may trigger several integer overflow scenarios, which would result with buffer overflow and heap corruption. We believe this could in certain conditions be exploited for remote code execution. By default, authenticated Redis users have access to all configuration parameters and can therefore use the “CONFIG SET proto-max-bulk-len” to change the safe default, making the system vulnerable. **This problem only affects 32-bit Redis (on a 32-bit system, or as a 32-bit executable running on a 64-bit system).** The problem is fixed in version 6.2, and the fix is back ported to 6.0.11 and 5.0.11. Make sure you use one of these versions if you are running 32-bit Redis. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent clients from directly executing `CONFIG SET`: Using Redis 6.0 or newer, ACL configuration can be used to block the command. Using older versions, the `rename-command` configuration directive can be used to rename the command to a random string unknown to users, rendering it inaccessible. Please note that this workaround may have an additional impact on users or operational systems that expect `CONFIG SET` to behave in certain ways.","status":"published","published":"2021-02-26T22:15:19.457Z","modified":"2026-06-17T03:35:15.94Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:06:50.399901Z"}],"osv":[{"id":"ALPINE-CVE-2021-21309","description":"Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and potentially result with remote code execution. Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the limit is significantly increased, receiving a large request from a client may trigger several integer overflow scenarios, which would result with buffer overflow and heap corruption. We believe this could in certain conditions be exploited for remote code execution. By default, authenticated Redis users have access to all configuration parameters and can therefore use the “CONFIG SET proto-max-bulk-len” to change the safe default, making the system vulnerable. **This problem only affects 32-bit Redis (on a 32-bit system, or as a 32-bit executable running on a 64-bit system).** The problem is fixed in version 6.2, and the fix is back ported to 6.0.11 and 5.0.11. Make sure you use one of these versions if you are running 32-bit Redis. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent clients from directly executing `CONFIG SET`: Using Redis 6.0 or newer, ACL configuration can be used to block the command. Using older versions, the `rename-command` configuration directive can be used to rename the command to a random string unknown to users, rendering it inaccessible. Please note that this workaround may have an additional impact on users or operational systems that expect `CONFIG SET` to behave in certain ways.","status":"published","published":"2021-02-26T22:15:19.457Z","modified":"2026-11-03T06:32:27.273215482Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:57.723967Z"},{"id":"AZL-6843","title":"CVE-2021-21309 affecting package redis for versions less than 5.0.5-7","description":"Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and potentially result with remote code execution. Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the limit is significantly increased, receiving a large request from a client may trigger several integer overflow scenarios, which would result with buffer overflow and heap corruption. We believe this could in certain conditions be exploited for remote code execution. By default, authenticated Redis users have access to all configuration parameters and can therefore use the “CONFIG SET proto-max-bulk-len” to change the safe default, making the system vulnerable. **This problem only affects 32-bit Redis (on a 32-bit system, or as a 32-bit executable running on a 64-bit system).** The problem is fixed in version 6.2, and the fix is back ported to 6.0.11 and 5.0.11. Make sure you use one of these versions if you are running 32-bit Redis. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent clients from directly executing `CONFIG SET`: Using Redis 6.0 or newer, ACL configuration can be used to block the command. Using older versions, the `rename-command` configuration directive can be used to rename the command to a random string unknown to users, rendering it inaccessible. Please note that this workaround may have an additional impact on users or operational systems that expect `CONFIG SET` to behave in certain ways.","status":"published","published":"2021-02-26T22:15:19Z","modified":"2026-04-21T04:38:24.658064Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:08.630357Z"},{"id":"BELL-CVE-2021-21309","title":"CVE-2021-21309 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:50.935211Z","modified":"2026-01-26T09:46:26.401616Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2021-21309","description":"Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and potentially result with remote code execution. Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the limit is significantly increased, receiving a large request from a client may trigger several integer overflow scenarios, which would result with buffer overflow and heap corruption. We believe this could in certain conditions be exploited for remote code execution. By default, authenticated Redis users have access to all configuration parameters and can therefore use the “CONFIG SET proto-max-bulk-len” to change the safe default, making the system vulnerable. **This problem only affects 32-bit Redis (on a 32-bit system, or as a 32-bit executable running on a 64-bit system).** The problem is fixed in version 6.2, and the fix is back ported to 6.0.11 and 5.0.11. Make sure you use one of these versions if you are running 32-bit Redis. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent clients from directly executing `CONFIG SET`: Using Redis 6.0 or newer, ACL configuration can be used to block the command. Using older versions, the `rename-command` configuration directive can be used to rename the command to a random string unknown to users, rendering it inaccessible. Please note that this workaround may have an additional impact on users or operational systems that expect `CONFIG SET` to behave in certain ways.","status":"published","published":"2021-02-26T22:15:19.457Z","modified":"2026-10-20T14:18:40.047092511Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:18.004149Z"},{"id":"DEBIAN-CVE-2021-21309","description":"Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and potentially result with remote code execution. Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the limit is significantly increased, receiving a large request from a client may trigger several integer overflow scenarios, which would result with buffer overflow and heap corruption. We believe this could in certain conditions be exploited for remote code execution. By default, authenticated Redis users have access to all configuration parameters and can therefore use the “CONFIG SET proto-max-bulk-len” to change the safe default, making the system vulnerable. **This problem only affects 32-bit Redis (on a 32-bit system, or as a 32-bit executable running on a 64-bit system).** The problem is fixed in version 6.2, and the fix is back ported to 6.0.11 and 5.0.11. Make sure you use one of these versions if you are running 32-bit Redis. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent clients from directly executing `CONFIG SET`: Using Redis 6.0 or newer, ACL configuration can be used to block the command. Using older versions, the `rename-command` configuration directive can be used to rename the command to a random string unknown to users, rendering it inaccessible. Please note that this workaround may have an additional impact on users or operational systems that expect `CONFIG SET` to behave in certain ways.","status":"published","published":"2021-02-26T22:15:19.457Z","modified":"2026-10-23T18:03:48.77264458Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"OESA-2021-1093","title":"redis security update","description":"Redis is an advanced key-value store. It is often referred to as a dattructure server since keys can contain strings, hashes ,lists, sets anorted sets.\r\n\r\nSecurity Fix(es):\r\n\r\nRedis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and potentially result with remote code execution. Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the limit is significantly increased, receiving a large request from a client may trigger several integer overflow scenarios, which would result with buffer overflow and heap corruption. We believe this could in certain conditions be exploited for remote code execution. By default, authenticated Redis users have access to all configuration parameters and can therefore use the “CONFIG SET proto-max-bulk-len” to change the safe default, making the system vulnerable. **This problem only affects 32-bit Redis (on a 32-bit system, or as a 32-bit executable running on a 64-bit system).** The problem is fixed in version 6.2, and the fix is back ported to 6.0.11 and 5.0.11. Make sure you use one of these versions if you are running 32-bit Redis. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent clients from directly executing `CONFIG SET`: Using Redis 6.0 or newer, ACL configuration can be used to block the command. Using older versions, the `rename-command` configuration directive can be used to rename the command to a random string unknown to users, rendering it inaccessible. Please note that this workaround may have an additional impact on users or operational systems that expect `CONFIG SET` to behave in certain ways.(CVE-2021-21309)","status":"published","published":"2021-03-26T11:04:19Z","modified":"2026-08-18T01:15:20.066983223Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"UBUNTU-CVE-2021-21309","description":"Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and potentially result with remote code execution. Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the limit is significantly increased, receiving a large request from a client may trigger several integer overflow scenarios, which would result with buffer overflow and heap corruption. We believe this could in certain conditions be exploited for remote code execution. By default, authenticated Redis users have access to all configuration parameters and can therefore use the “CONFIG SET proto-max-bulk-len” to change the safe default, making the system vulnerable. **This problem only affects 32-bit Redis (on a 32-bit system, or as a 32-bit executable running on a 64-bit system).** The problem is fixed in version 6.2, and the fix is back ported to 6.0.11 and 5.0.11. Make sure you use one of these versions if you are running 32-bit Redis. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent clients from directly executing `CONFIG SET`: Using Redis 6.0 or newer, ACL configuration can be used to block the command. Using older versions, the `rename-command` configuration directive can be used to rename the command to a random string unknown to users, rendering it inaccessible. Please note that this workaround may have an additional impact on users or operational systems that expect `CONFIG SET` to behave in certain ways.","status":"published","published":"2021-02-26T22:15:00Z","modified":"2026-02-04T02:25:46.53533Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:54:26.29421Z"},{"id":"DLA-2576-1","title":"redis - security update","status":"published","published":"2021-02-25T00:00:00Z","modified":"2026-03-09T01:22:00.784977Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"MGASA-2021-0155","title":"Updated redis packages fix security vulnerability","description":"It was discovered that there were a number of integer overflow issues in Redis.\nIt is currently believed that the issues only affect 32-bit based systems\n(CVE-2021-21309).\n","status":"published","published":"2021-03-27T14:27:02Z","modified":"2026-04-16T04:41:04.048466465Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"MGASA-2021-0317","title":"Updated redis package fixes a security vulnerability","description":"It was discovered that there were a number of integer overflow issues in Redis.\nIt is currently believed that the issues only affect 32-bit based systems\n(CVE-2021-21309).\n","status":"published","published":"2021-07-08T22:43:19Z","modified":"2026-04-16T04:42:41.701150811Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:0682-1","title":"Security update for redis","description":"This update for redis fixes the following issues:\n\nredis 6.0.13\n\n* CVE-2021-29477: Integer overflow in STRALGO LCS command (boo#1185729)\n* CVE-2021-29478: Integer overflow in COPY command for large intsets (boo#1185730)\n* Cluster: Skip unnecessary check which may prevent failure detection\n* Fix performance regression in BRPOP on Redis 6.0\n* Fix edge-case when a module client is unblocked\n\nredis 6.0.12:\n\n* Fix compilation error on non-glibc systems if jemalloc is not used\n\nredis 6.0.11:\n\n* CVE-2021-21309: Avoid 32-bit overflows when proto-max-bulk-len\n  is set high (boo#1182657)\n* Fix handling of threaded IO and CLIENT PAUSE (failover), could\n  lead to data loss or a crash\n* Fix the selection of a random element from large hash tables\n* Fix broken protocol in client tracking tracking-redir-broken message\n* XINFO able to access expired keys on a replica\n* Fix broken protocol in redis-benchmark when used with -a or --dbnum \n* Avoid assertions (on older kernels) when testing arm64 CoW bug\n* CONFIG REWRITE should honor umask settings\n* Fix firstkey,lastkey,step in COMMAND command for some commands\n* RM_ZsetRem: Delete key if empty, the bug could leave empty\n  zset keys \n\nredis 6.0.10:\n\nCommand behavior changes:\n\n* SWAPDB invalidates WATCHed keys (#8239)\n* SORT command behaves differently when used on a writable replica (#8283)\n* EXISTS should not alter LRU (#8016)\n  In Redis 5.0 and 6.0 it would have touched the LRU/LFU of the key.\n* OBJECT should not reveal logically expired keys (#8016)\n  Will now behave the same TYPE or any other non-DEBUG command.\n* GEORADIUS[BYMEMBER] can fail with -OOM if Redis is over the memory limit (#8107)\n\nOther behavior changes:\n\n* Sentinel: Fix missing updates to the config file after SENTINEL SET command (#8229)\n* CONFIG REWRITE is atomic and safer, but requires write access to the config file's folder (#7824, #8051)\n  This change was already present in 6.0.9, but was missing from the release notes.\n\nBug fixes with compatibility implications (bugs introduced in Redis 6.0):\n\n* Fix RDB CRC64 checksum on big-endian systems (#8270)\n  If you're using big-endian please consider the compatibility implications with\n  RESTORE, replication and persistence.\n* Fix wrong order of key/value in Lua's map response (#8266)\n  If your scripts use redis.setresp() or return a map (new in Redis 6.0), please\n  consider the implications.\n\nBug fixes:\n\n* Fix an issue where a forked process deletes the parent's pidfile (#8231)\n* Fix crashes when enabling io-threads-do-reads (#8230)\n* Fix a crash in redis-cli after executing cluster backup (#8267)\n* Handle output buffer limits for module blocked clients (#8141)\n  Could result in a module sending reply to a blocked client to go beyond the limit.\n* Fix setproctitle related crashes. (#8150, #8088)\n  Caused various crashes on startup, mainly on Apple M1 chips or under instrumentation.\n* Backup/restore cluster mode keys to slots map for repl-diskless-load=swapdb (#8108)\n  In cluster mode with repl-diskless-load, when loading failed, slot map wouldn't\n  have been restored.\n* Fix oom-score-adj-values range, and bug when used in config file (#8046)\n  Enabling setting this in the config file in a line after enabling it, would\n  have been buggy.\n* Reset average ttl when empty databases (#8106)\n  Just causing misleading metric in INFO\n* Disable rehash when Redis has child process (#8007)\n  This could have caused excessive CoW during BGSAVE, replication or AOFRW.\n* Further improved ACL algorithm for picking categories (#7966)\n  Output of ACL GETUSER is now more similar to the one provided by ACL SETUSER.\n* Fix bug with module GIL being released prematurely (#8061)\n  Could in theory (and rarely) cause multi-threaded modules to corrupt memory.\n* Reduce effect of client tracking causing feedback loop in key eviction (#8100)\n* Fix cluster access to unaligned memory (SIGBUS on old ARM) (#7958)\n* Fix saving of strings larger than 2GB into RDB files (#8306)\n\nAdditional improvements:\n\n* Avoid wasteful transient memory allocation in certain cases (#8286, #5954)\n\nPlatform / toolchain support related improvements:\n\n* Fix crash log registers output on ARM. (#8020)\n* Add a check for an ARM64 Linux kernel bug (#8224)\n  Due to the potential severity of this issue, Redis will print log warning on startup.\n* Raspberry build fix. (#8095)\n\nNew configuration options:\n\n* oom-score-adj-values config can now take absolute values (besides relative ones) (#8046)\n\nModule related fixes:\n\n* Moved RMAPI_FUNC_SUPPORTED so that it's usable (#8037)\n* Improve timer accuracy (#7987)\n* Allow '\\0' inside of result of RM_CreateStringPrintf (#6260)\n\nredis 6.0.9:\n\n* potential heap overflow when using a heap allocator other\n  than jemalloc or glibc's malloc. Does not affect the openSUSE\n  package - boo#1178205 \n* Memory reporting of clients argv\n* Add redis-cli control on raw format line delimiter\n* Add redis-cli support for rediss:// -u prefix\n* WATCH no longer ignores keys which have expired for MULTI/EXEC\n* Correct OBJECT ENCODING response for stream type\n* Allow blocked XREAD on a cluster replica\n* TLS: Do not require CA config if not used\n* multiple bug fixes\n* Additions to modules API\n\nredis 6.0.8 (jsc#PM-1615, jsc#PM-1622, jsc#PM-1681, jsc#ECO-2417, jsc#ECO-2867, jsc#PM-1547, jsc#CAPS-56, jsc#SLE-11578, jsc#SLE-12821):\n\n* bug fixes when using with Sentinel\n* bug fixes when using CONFIG REWRITE\n* Remove THP warning when set to madvise\n* Allow EXEC with read commands on readonly replica in cluster\n* Add masters/replicas options to redis-cli --cluster call command\n- includes changes from 6.0.7:\n* CONFIG SET could hung the client when arrives during RDB/ROF\n  loading\n* LPOS command when RANK is greater than matches responded with\n  broken protocol\n* Add oom-score-adj configuration option to control Linux OOM\n  killer\n* Show IO threads statistics and status in INFO output\n* Add optional tls verification mode (see tls-auth-clients)\n\nredis 6.0.6:\n\n* Fix crash when enabling CLIENT TRACKING with prefix\n* EXEC always fails with EXECABORT and multi-state is cleared\n* RESTORE ABSTTL won't store expired keys into the db\n* redis-cli better handling of non-pritable key names\n* TLS: Ignore client cert when tls-auth-clients off\n* Tracking: fix invalidation message on flush\n* Notify systemd on Sentinel startup\n* Fix crash on a misuse of STRALGO\n* Few fixes in module API\n* Fix a few rare leaks (STRALGO error misuse, Sentinel)\n* Fix a possible invalid access in defrag of scripts\n* Add LPOS command to search in a list\n* Use user+pass for MIGRATE in redis-cli and redis-benchmark in\n  cluster mode\n* redis-cli support TLS for --pipe, --rdb and --replica options\n* TLS: Session caching configuration support\n\nredis 6.0.5:\n\n* Fix handling of speical chars in ACL LOAD\n* Make Redis Cluster more robust about operation errors that may\n  lead to two clusters to mix together\n* Revert the sendfile() implementation of RDB transfer\n* Fix TLS certificate loading for chained certificates\n* Fix AOF rewirting of KEEPTTL SET option\n* Fix MULTI/EXEC behavior during -BUSY script errors\n","status":"published","published":"2021-05-07T18:41:45Z","modified":"2025-05-07T18:12:25.890261Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:11299-1","title":"redis-6.2.5-1.2 on GA media","description":"These are all security issues fixed in the redis-6.2.5-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:57:18.461644Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2021:1652-1","title":"Security update for redis","description":"This update for redis fixes the following issues:\n\nredis was updated to 6.0.13:\n\n* CVE-2021-29477: Integer overflow in STRALGO LCS command (bsc#1185729)\n* CVE-2021-29478: Integer overflow in COPY command for large intsets (bsc#1185730)\n* Cluster: Skip unnecessary check which may prevent failure detection\n* Fix performance regression in BRPOP on Redis 6.0\n* Fix edge-case when a module client is unblocked\n\nredis 6.0.12:\n\n* Fix compilation error on non-glibc systems if jemalloc is not used\n\nredis 6.0.11:\n\n* CVE-2021-21309: Avoid 32-bit overflows when proto-max-bulk-len\n  is set high (bsc#1182657)\n* Fix handling of threaded IO and CLIENT PAUSE (failover), could\n  lead to data loss or a crash\n* Fix the selection of a random element from large hash tables\n* Fix broken protocol in client tracking tracking-redir-broken message\n* XINFO able to access expired keys on a replica\n* Fix broken protocol in redis-benchmark when used with -a or\n  --dbnum \n* Avoid assertions (on older kernels) when testing arm64 CoW bug\n* CONFIG REWRITE should honor umask settings\n* Fix firstkey,lastkey,step in COMMAND command for some commands\n* RM_ZsetRem: Delete key if empty, the bug could leave empty\n  zset keys \n\n- Switch systemd type of the sentinel service from notify to simple. This can\n  be reverted when updating to 6.2 which fixes\n  https://github.com/redis/redis/issues/7284 .\n","status":"published","published":"2021-05-19T12:30:32Z","modified":"2026-02-04T04:20:10.341721Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"USN-5221-1","title":"redis vulnerabilities","description":"It was discovered that Redis incorrectly handled certain specially crafted\nLua scripts. A remote attacker could possibly use this issue to cause a\ndenial of service or execute arbitrary code. (CVE-2021-32626)\n\nIt was discovered that Redis incorrectly handled some malformed requests\nwhen using Redis Lua Debugger. A remote attacker could possibly use this\nissue to cause a denial of service or other unspecified impact. This issue\nonly affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2021-32672)\n\nIt was discovered that Redis incorrectly handled certain Redis Standard\nProtocol (RESP) requests. A remote attacker could possibly use this issue\nto cause a denial of service. (CVE-2021-32675)\n\nIt was discovered that Redis incorrectly handled some configuration\nparameters with specially crafted network payloads. A remote attacker\ncould possibly use this issue to cause a denial of service or execute\narbitrary code. Vulnerabilities CVE-2021-32627 and CVE-2021-41099\nonly affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM.\n(CVE-2021-32627, CVE-2021-32628, CVE-2021-32687, CVE-2021-41099).\n\nIt was discovered that Redis incorrectly handled memory when processing\ncertain input in 32-bit systems. A remote attacker could possibly use\nthis issue to cause a denial of service or execute arbitrary code.\nOne vulnerability (CVE-2021-32761) only affected Ubuntu 14.04 ESM,\nUbuntu 16.04 ESM and Ubuntu 18.04 ESM and another vulnerability\n(CVE-2021-21309) only affected Ubuntu 18.04 ESM.\n(CVE-2021-32761, CVE-2021-21309).\n","status":"published","published":"2022-08-03T10:10:42Z","modified":"2026-06-29T13:48:57.518583234Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}