{"id":"CVE-2021-32761","aliases":["ALPINE-CVE-2021-32761","AZL-6850","BELL-CVE-2021-32761","DEBIAN-CVE-2021-32761","DLA-2717-1","DLA-2717-2","EUVD-2021-19529","GHSA-8wxq-j7rp-g8wj","MGASA-2021-0373","UBUNTU-CVE-2021-32761","USN-5221-1","openSUSE-SU-2024:11299-1"],"status":"published","title":"Integer overflow issues with *BIT commands on 32-bit systems","description":"Redis is an in-memory database that persists on disk. A vulnerability involving out-of-bounds read and integer overflow to buffer overflow exists starting with version 2.2 and prior to versions 5.0.13, 6.0.15, and 6.2.5. On 32-bit systems, Redis `*BIT*` command are vulnerable to integer overflow that can potentially be exploited to corrupt the heap, leak arbitrary heap contents or trigger remote code execution. The vulnerability involves changing the default `proto-max-bulk-len` configuration parameter to a very large value and constructing specially crafted commands bit commands. This problem only affects Redis on 32-bit platforms, or compiled as a 32-bit binary. Redis versions 5.0.`3m 6.0.15, and 6.2.5 contain patches for this issue. An additional workaround to mitigate the problem without patching the `redis-server` executable is to prevent users from modifying the `proto-max-bulk-len` configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.30103,"percentile":0.98239,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125","CWE-190","CWE-680"],"published":"2021-07-21T20:50:09Z","modified":"2026-11-03T06:32:34Z","fixes":[{"ecosystem":"Alpine:v3.11","package":"redis","fixed_in":["5.0.13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"redis","fixed_in":["5.0.13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"redis","fixed_in":["6.0.13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"redis","fixed_in":["6.2.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"redis","fixed_in":["6.2.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"redis","fixed_in":["6.2.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"redis","fixed_in":["6.2.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"redis","fixed_in":["6.2.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"redis","fixed_in":["6.2.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"redis","fixed_in":["6.2.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"redis","fixed_in":["6.2.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"redis","fixed_in":["6.2.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"redis","fixed_in":["6.2.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"redis","fixed_in":["6.2.5-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"redis","fixed_in":["6.2.5-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"redis","fixed_in":["5:6.0.15-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"redis","fixed_in":["5:6.0.15-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"redis","fixed_in":["5:6.0.15-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"redis","fixed_in":["3:3.2.6-3+deb9u5","3:3.2.6-3+deb9u6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"redis","fixed_in":["2:2.8.4-2ubuntu0.2+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"redis","fixed_in":["2:3.0.6-1ubuntu0.4+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"redis","fixed_in":["5:4.0.9-1ubuntu0.2+esm3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.11","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"5.0.13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"5.0.13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"6.0.13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"6.2.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"6.2.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"6.2.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"6.2.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"6.2.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"6.2.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"6.2.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"6.2.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"6.2.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"6.2.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"6.2.5-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.5-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:6.0.15-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:6.0.15-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:6.0.15-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:3.2.6-3+deb9u5"}]}],"versions":["3:3.2.6-1","3:3.2.6-2","3:3.2.6-3","3:3.2.6-3+deb9u1","3:3.2.6-3+deb9u2","3:3.2.6-3+deb9u3","3:3.2.6-3+deb9u4"]},{"source":"osv","ecosystem":"Debian:9","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:3.2.6-3+deb9u6"}]}],"versions":["3:3.2.6-1","3:3.2.6-2","3:3.2.6-3","3:3.2.6-3+deb9u1","3:3.2.6-3+deb9u2","3:3.2.6-3+deb9u3","3:3.2.6-3+deb9u4","3:3.2.6-3+deb9u5"]},{"source":"osv","ecosystem":"Mageia:8","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.15-1.mga8"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.8.4-2ubuntu0.2+esm2"}]}],"versions":["2:2.6.13-1","2:2.6.16-3","2:2.8.0-1","2:2.8.2-1","2:2.8.4-2","2:2.8.4-2ubuntu0.2","2:2.8.4-2ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.0.6-1ubuntu0.4+esm1"}]}],"versions":["2:3.0.3-3","2:3.0.5-1","2:3.0.5-2","2:3.0.5-3","2:3.0.5-4","2:3.0.6-1","2:3.0.6-1ubuntu0.2","2:3.0.6-1ubuntu0.3","2:3.0.6-1ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:4.0.9-1ubuntu0.2+esm3"}]}],"versions":["4:4.0.1-7","4:4.0.2-6","4:4.0.2-9","5:4.0.5-1","5:4.0.6-1","5:4.0.6-2","5:4.0.7-1","5:4.0.8-1","5:4.0.8-2","5:4.0.9-1","5:4.0.9-1ubuntu0.1","5:4.0.9-1ubuntu0.2","5:4.0.9-1ubuntu0.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.8.4-2ubuntu0.2+esm2"}]}],"versions":["2:2.6.13-1","2:2.6.16-3","2:2.8.0-1","2:2.8.2-1","2:2.8.4-2","2:2.8.4-2ubuntu0.2","2:2.8.4-2ubuntu0.2+esm1"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.0.6-1ubuntu0.4+esm1"}]}],"versions":["2:3.0.3-3","2:3.0.5-1","2:3.0.5-2","2:3.0.5-3","2:3.0.5-4","2:3.0.6-1","2:3.0.6-1ubuntu0.2","2:3.0.6-1ubuntu0.3","2:3.0.6-1ubuntu0.4"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:4.0.9-1ubuntu0.2+esm3"}]}],"versions":["4:4.0.1-7","4:4.0.2-6","4:4.0.2-9","5:4.0.5-1","5:4.0.6-1","5:4.0.6-2","5:4.0.7-1","5:4.0.8-1","5:4.0.8-2","5:4.0.9-1","5:4.0.9-1ubuntu0.1","5:4.0.9-1ubuntu0.2","5:4.0.9-1ubuntu0.2+esm2"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.0.7-2ubuntu0.1+esm1"}]}],"versions":["5:5.0.5-2build1","5:5.0.6-1","5:5.0.7-1","5:5.0.7-2","5:5.0.7-2ubuntu0.1~esm1","5:5.0.7-2ubuntu0.1"],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.5-1.2"}]}],"bundled":9}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"redis","product":"redis"},{"vendor":"redislabs","product":"redis"}],"references":[{"url":"https://github.com/redis/redis/security/advisories/GHSA-8wxq-j7rp-g8wj","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/07/msg00017.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VGX7RRAWGXWXEAKJTQYSDSBO2BC3SAHD/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6O7AUOROBYGP5IMGJPC5HZ3R2RB6GZ5X/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20210827-0004/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/08/msg00026.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2021/dsa-5001","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202209-17","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-32761","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32761","tags":["web"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-32761","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-32761","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0373.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29036","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/BPWBIZXA67JFIB63W2CNVVILCGIC2ME5/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/BHWOF7CBVUGDK3AN6H3BN3VNTH2TDUZZ/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/SN7INTZFE34MIQJO7WDDTIY5LIBGN6GI/","tags":["web"]},{"url":"https://www.debian.org/lts/security/2021/dla-2717","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-32761","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5221-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-32761","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21309","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-32626","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-32627","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-32628","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-32672","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-32675","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-32687","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-41099","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29478","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32761","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-32761","title":"Integer overflow issues with *BIT commands on 32-bit systems","description":"Redis is an in-memory database that persists on disk. A vulnerability involving out-of-bounds read and integer overflow to buffer overflow exists starting with version 2.2 and prior to versions 5.0.13, 6.0.15, and 6.2.5. On 32-bit systems, Redis `*BIT*` command are vulnerable to integer overflow that can potentially be exploited to corrupt the heap, leak arbitrary heap contents or trigger remote code execution. The vulnerability involves changing the default `proto-max-bulk-len` configuration parameter to a very large value and constructing specially crafted commands bit commands. This problem only affects Redis on 32-bit platforms, or compiled as a 32-bit binary. Redis versions 5.0.`3m 6.0.15, and 6.2.5 contain patches for this issue. An additional workaround to mitigate the problem without patching the `redis-server` executable is to prevent users from modifying the `proto-max-bulk-len` configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.","status":"published","published":"2021-07-21T20:50:09Z","modified":"2024-08-03T23:33:55.821Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-125","CWE-680"],"updated_at":"2026-11-02T14:33:07.014772Z"}],"euvd":[{"id":"EUVD-2021-19529","description":"Redis is an in-memory database that persists on disk. A vulnerability involving out-of-bounds read and integer overflow to buffer overflow exists starting with version 2.2 and prior to versions 5.0.13, 6.0.15, and 6.2.5. On 32-bit systems, Redis `*BIT*` command are vulnerable to integer overflow that can potentially be exploited to corrupt the heap, leak arbitrary heap contents or trigger remote code execution. The vulnerability involves changing the default `proto-max-bulk-len` configuration parameter to a very large value and constructing specially crafted commands bit commands. This problem only affects Redis on 32-bit platforms, or compiled as a 32-bit binary. Redis versions 5.0.`3m 6.0.15, and 6.2.5 contain patches for this issue. An additional workaround to mitigate the problem without patching the `redis-server` executable is to prevent users from modifying the `proto-max-bulk-len` configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.","status":"published","published":"2021-07-21T20:50:09Z","modified":"2024-08-03T23:33:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:24:35.855495Z"}],"nvd":[{"id":"CVE-2021-32761","description":"Redis is an in-memory database that persists on disk. A vulnerability involving out-of-bounds read and integer overflow to buffer overflow exists starting with version 2.2 and prior to versions 5.0.13, 6.0.15, and 6.2.5. On 32-bit systems, Redis `*BIT*` command are vulnerable to integer overflow that can potentially be exploited to corrupt the heap, leak arbitrary heap contents or trigger remote code execution. The vulnerability involves changing the default `proto-max-bulk-len` configuration parameter to a very large value and constructing specially crafted commands bit commands. This problem only affects Redis on 32-bit platforms, or compiled as a 32-bit binary. Redis versions 5.0.`3m 6.0.15, and 6.2.5 contain patches for this issue. An additional workaround to mitigate the problem without patching the `redis-server` executable is to prevent users from modifying the `proto-max-bulk-len` configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.","status":"published","published":"2021-07-21T21:15:07.67Z","modified":"2026-06-17T03:53:34.54Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6,"vector":"AV:N/AC:M/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125","CWE-680","CWE-190"],"updated_at":"2026-11-02T14:06:56.185362Z"}],"osv":[{"id":"ALPINE-CVE-2021-32761","description":"Redis is an in-memory database that persists on disk. A vulnerability involving out-of-bounds read and integer overflow to buffer overflow exists starting with version 2.2 and prior to versions 5.0.13, 6.0.15, and 6.2.5. On 32-bit systems, Redis `*BIT*` command are vulnerable to integer overflow that can potentially be exploited to corrupt the heap, leak arbitrary heap contents or trigger remote code execution. The vulnerability involves changing the default `proto-max-bulk-len` configuration parameter to a very large value and constructing specially crafted commands bit commands. This problem only affects Redis on 32-bit platforms, or compiled as a 32-bit binary. Redis versions 5.0.`3m 6.0.15, and 6.2.5 contain patches for this issue. An additional workaround to mitigate the problem without patching the `redis-server` executable is to prevent users from modifying the `proto-max-bulk-len` configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.","status":"published","published":"2021-07-21T21:15:07.67Z","modified":"2026-11-03T06:32:34.198663929Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:20.312441Z"},{"id":"AZL-6850","title":"CVE-2021-32761 affecting package redis for versions less than 6.2.5-1","description":"Redis is an in-memory database that persists on disk. A vulnerability involving out-of-bounds read and integer overflow to buffer overflow exists starting with version 2.2 and prior to versions 5.0.13, 6.0.15, and 6.2.5. On 32-bit systems, Redis `*BIT*` command are vulnerable to integer overflow that can potentially be exploited to corrupt the heap, leak arbitrary heap contents or trigger remote code execution. The vulnerability involves changing the default `proto-max-bulk-len` configuration parameter to a very large value and constructing specially crafted commands bit commands. This problem only affects Redis on 32-bit platforms, or compiled as a 32-bit binary. Redis versions 5.0.`3m 6.0.15, and 6.2.5 contain patches for this issue. An additional workaround to mitigate the problem without patching the `redis-server` executable is to prevent users from modifying the `proto-max-bulk-len` configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.","status":"published","published":"2021-07-21T21:15:07Z","modified":"2026-04-21T04:38:25.838585Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:08.630357Z"},{"id":"BELL-CVE-2021-32761","title":"CVE-2021-32761 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:29.33419Z","modified":"2026-01-26T09:45:51.886009Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2021-32761","description":"Redis is an in-memory database that persists on disk. A vulnerability involving out-of-bounds read and integer overflow to buffer overflow exists starting with version 2.2 and prior to versions 5.0.13, 6.0.15, and 6.2.5. On 32-bit systems, Redis `*BIT*` command are vulnerable to integer overflow that can potentially be exploited to corrupt the heap, leak arbitrary heap contents or trigger remote code execution. The vulnerability involves changing the default `proto-max-bulk-len` configuration parameter to a very large value and constructing specially crafted commands bit commands. This problem only affects Redis on 32-bit platforms, or compiled as a 32-bit binary. Redis versions 5.0.`3m 6.0.15, and 6.2.5 contain patches for this issue. An additional workaround to mitigate the problem without patching the `redis-server` executable is to prevent users from modifying the `proto-max-bulk-len` configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.","status":"published","published":"2021-07-21T21:15:07.67Z","modified":"2026-10-20T10:54:42.786498559Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:19.793849Z"},{"id":"DEBIAN-CVE-2021-32761","description":"Redis is an in-memory database that persists on disk. A vulnerability involving out-of-bounds read and integer overflow to buffer overflow exists starting with version 2.2 and prior to versions 5.0.13, 6.0.15, and 6.2.5. On 32-bit systems, Redis `*BIT*` command are vulnerable to integer overflow that can potentially be exploited to corrupt the heap, leak arbitrary heap contents or trigger remote code execution. The vulnerability involves changing the default `proto-max-bulk-len` configuration parameter to a very large value and constructing specially crafted commands bit commands. This problem only affects Redis on 32-bit platforms, or compiled as a 32-bit binary. Redis versions 5.0.`3m 6.0.15, and 6.2.5 contain patches for this issue. An additional workaround to mitigate the problem without patching the `redis-server` executable is to prevent users from modifying the `proto-max-bulk-len` configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.","status":"published","published":"2021-07-21T21:15:07.67Z","modified":"2026-10-23T18:03:03.127942033Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"UBUNTU-CVE-2021-32761","description":"Redis is an in-memory database that persists on disk. A vulnerability involving out-of-bounds read and integer overflow to buffer overflow exists starting with version 2.2 and prior to versions 5.0.13, 6.0.15, and 6.2.5. On 32-bit systems, Redis `*BIT*` command are vulnerable to integer overflow that can potentially be exploited to corrupt the heap, leak arbitrary heap contents or trigger remote code execution. The vulnerability involves changing the default `proto-max-bulk-len` configuration parameter to a very large value and constructing specially crafted commands bit commands. This problem only affects Redis on 32-bit platforms, or compiled as a 32-bit binary. Redis versions 5.0.`3m 6.0.15, and 6.2.5 contain patches for this issue. An additional workaround to mitigate the problem without patching the `redis-server` executable is to prevent users from modifying the `proto-max-bulk-len` configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.","status":"published","published":"2021-07-21T21:15:00Z","modified":"2026-02-04T02:55:51.733677Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:27.332852Z"},{"id":"DLA-2717-1","title":"redis - security update","status":"published","published":"2021-07-22T00:00:00Z","modified":"2026-03-09T01:19:06.029837Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DLA-2717-2","title":"redis - regression update","status":"published","published":"2021-08-27T00:00:00Z","modified":"2026-03-09T01:21:32.670454Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"MGASA-2021-0373","title":"Updated redis package fixes security vulnerabilities","description":"An integer overflow bug in Redis version 6.0 or newer could be exploited using\nthe `STRALGO LCS` command to corrupt the heap and potentially result with\nremote code execution (CVE-2021-29477).\n\nAn integer overflow bug in Redis 6.2 before 6.2.3 could be exploited to corrupt\nthe heap and potentially result with remote code execution (CVE-2021-29478).\n\nA vulnerability involving out-of-bounds read and integer overflow to buffer\noverflow exists starting with version 2.2 and prior to versions 5.0.13, 6.0.15\nand 6.2.5. On 32-bit systems, Redis `*BIT*` command are vulnerable to integer\noverflow that can potentially be exploited to corrupt the heap, leak arbitrary\nheap contents or trigger remote code execution (CVE-2021-32761).\n","status":"published","published":"2021-07-25T14:45:06Z","modified":"2026-04-16T04:41:43.84162527Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2024:11299-1","title":"redis-6.2.5-1.2 on GA media","description":"These are all security issues fixed in the redis-6.2.5-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:57:18.461644Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"USN-5221-1","title":"redis vulnerabilities","description":"It was discovered that Redis incorrectly handled certain specially crafted\nLua scripts. A remote attacker could possibly use this issue to cause a\ndenial of service or execute arbitrary code. (CVE-2021-32626)\n\nIt was discovered that Redis incorrectly handled some malformed requests\nwhen using Redis Lua Debugger. A remote attacker could possibly use this\nissue to cause a denial of service or other unspecified impact. This issue\nonly affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2021-32672)\n\nIt was discovered that Redis incorrectly handled certain Redis Standard\nProtocol (RESP) requests. A remote attacker could possibly use this issue\nto cause a denial of service. (CVE-2021-32675)\n\nIt was discovered that Redis incorrectly handled some configuration\nparameters with specially crafted network payloads. A remote attacker\ncould possibly use this issue to cause a denial of service or execute\narbitrary code. Vulnerabilities CVE-2021-32627 and CVE-2021-41099\nonly affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM.\n(CVE-2021-32627, CVE-2021-32628, CVE-2021-32687, CVE-2021-41099).\n\nIt was discovered that Redis incorrectly handled memory when processing\ncertain input in 32-bit systems. A remote attacker could possibly use\nthis issue to cause a denial of service or execute arbitrary code.\nOne vulnerability (CVE-2021-32761) only affected Ubuntu 14.04 ESM,\nUbuntu 16.04 ESM and Ubuntu 18.04 ESM and another vulnerability\n(CVE-2021-21309) only affected Ubuntu 18.04 ESM.\n(CVE-2021-32761, CVE-2021-21309).\n","status":"published","published":"2022-08-03T10:10:42Z","modified":"2026-06-29T13:48:57.518583234Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}