Skip to content
OpenAdvisories
High USN-5221-1 9 CVEs

redis vulnerabilities

Published Aug 3, 2022 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Redis incorrectly handled certain specially crafted
Lua scripts. A remote attacker could possibly use this issue to cause a
denial of service or execute arbitrary code. (CVE-2021-32626)

It was discovered that Redis incorrectly handled some malformed requests
when using Redis Lua Debugger. A remote attacker could possibly use this
issue to cause a denial of service or other unspecified impact. This issue
only affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2021-32672)

It was discovered that Redis incorrectly handled certain Redis Standard
Protocol (RESP) requests. A remote attacker could possibly use this issue
to cause a denial of service. (CVE-2021-32675)

It was discovered that Redis incorrectly handled some configuration
parameters with specially crafted network payloads. A remote attacker
could possibly use this issue to cause a denial of service or execute
arbitrary code. Vulnerabilities CVE-2021-32627 and CVE-2021-41099
only affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM.
(CVE-2021-32627, CVE-2021-32628, CVE-2021-32687, CVE-2021-41099).

It was discovered that Redis incorrectly handled memory when processing
certain input in 32-bit systems. A remote attacker could possibly use
this issue to cause a denial of service or execute arbitrary code.
One vulnerability (CVE-2021-32761) only affected Ubuntu 14.04 ESM,
Ubuntu 16.04 ESM and Ubuntu 18.04 ESM and another vulnerability
(CVE-2021-21309) only affected Ubuntu 18.04 ESM.
(CVE-2021-32761, CVE-2021-21309).

Fixed packages 4

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS redis 2:2.8.4-2ubuntu0.2+esm2
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS redis 2:3.0.6-1ubuntu0.4+esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS redis 5:4.0.9-1ubuntu0.2+esm3
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS redis 5:5.0.7-2ubuntu0.1+esm1

Vulnerabilities 9

  • High 7.5
    CVE-2021-32626 EPSS 16%

    Lua scripts can overflow the heap-based Lua stack in Redis

    Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted Lua scripts executing in Redis can cause the heap-based Lua stack to be overflowed, due to incomplete checks for this condition. This can result with hea…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2021-32627

    Integer overflow issue with Streams in Redis

    Redis is an open source, in-memory database that persists on disk. In affected versions an integer overflow bug in Redis can be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves changing the default pr…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2021-32628 EPSS 13%

    Vulnerability in handling large ziplists

    Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the ziplist data structure used by all versions of Redis can be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability in…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2021-32675 Public exploit EPSS 16%

    DoS vulnerability in Redis

    Redis is an open source, in-memory database that persists on disk. When parsing an incoming Redis Standard Protocol (RESP) request, Redis allocates memory according to user-specified values which determine the number of elements (in the multi-bulk header) and…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2021-32687

    Integer overflow issue with intsets in Redis

    Redis is an open source, in-memory database that persists on disk. An integer overflow bug affecting all versions of Redis can be exploited to corrupt the heap and potentially be used to leak arbitrary contents of the heap or trigger remote code execution. Th…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2021-32761 EPSS 30%

    Integer overflow issues with *BIT commands on 32-bit systems

    Redis is an in-memory database that persists on disk. A vulnerability involving out-of-bounds read and integer overflow to buffer overflow exists starting with version 2.2 and prior to versions 5.0.13, 6.0.15, and 6.2.5. On 32-bit systems, Redis `*BIT*` comma…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2021-41099

    Integer overflow issue with strings in Redis

    Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the underlying string library can be used to corrupt the heap and potentially result with denial of service or remote code execution. The vulnerability involves chan…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • Medium 5.4
    CVE-2021-21309

    Integer overflow on 32-bit systems

    Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and potentially result with remote code execution. Redis 4.0 o…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • Medium 5.3
    CVE-2021-32672

    Vulnerability in Lua Debugger in Redis

    Redis is an open source, in-memory database that persists on disk. When using the Redis Lua Debugger, users can send malformed requests that cause the debugger’s protocol parser to read data beyond the actual buffer. This issue affects all versions of Redis w…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine

References

  • report
    https://ubuntu.com/security/CVE-2021-21309
  • report
    https://ubuntu.com/security/CVE-2021-32626
  • report
    https://ubuntu.com/security/CVE-2021-32627
  • report
    https://ubuntu.com/security/CVE-2021-32628
  • report
    https://ubuntu.com/security/CVE-2021-32672
  • report
    https://ubuntu.com/security/CVE-2021-32675
  • report
    https://ubuntu.com/security/CVE-2021-32687
  • report
    https://ubuntu.com/security/CVE-2021-32761
  • report
    https://ubuntu.com/security/CVE-2021-41099