CVE-2021-3470

MEDIUM

Redis < 5.0.10, < 6.0.9, < 6.2.0 - Heap Overflow via Non-Jemalloc/Glibc Allocator

Title source: llm

Description

A heap overflow issue was found in Redis in versions before 5.0.10, before 6.0.9 and before 6.2.0 when using a heap allocator other than jemalloc or glibc's malloc, leading to potential out of bound write or process crash. Effectively this flaw does not affect the vast majority of users, who use jemalloc or glibc malloc.

References (1)

Core 1

Core References

Issue Tracking, Patch, Third Party Advisory x_refsource_misc

https://bugzilla.redhat.com/show_bug.cgi?id=1943623

Scores

CVSS v3 5.3

EPSS 0.0114

EPSS Percentile 62.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Details

CWE

CWE-119 CWE-787

Status published

Products (2)

redislabs/redis 6.2.0 rc1 (3 CPE variants)

redislabs/redis < 5.0.10

Published Mar 31, 2021

Tracked Since Feb 18, 2026