CVE-2021-32672

MEDIUM

Redis <6.2.6-5.0.14 - Use After Free

Title source: llm
STIX 2.1

Description

Redis is an open source, in-memory database that persists on disk. When using the Redis Lua Debugger, users can send malformed requests that cause the debugger’s protocol parser to read data beyond the actual buffer. This issue affects all versions of Redis with Lua debugging support (3.2 or newer). The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14.

References (9)

Core 9
Core References
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2021/dsa-5001
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpuapr2022.html
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20211104-0003/
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/202209-17

Scores

CVSS v3 5.3
EPSS 0.0029
EPSS Percentile 52.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-125
Status published
Products (13)
debian/debian_linux 10.0
debian/debian_linux 11.0
fedoraproject/fedora 33
fedoraproject/fedora 34
fedoraproject/fedora 35
netapp/management_services_for_element_software
netapp/management_services_for_netapp_hci
oracle/communications_operations_monitor 4.3
oracle/communications_operations_monitor 4.4
oracle/communications_operations_monitor 5.0
... and 3 more
Published Oct 04, 2021
Tracked Since Feb 18, 2026