{"api_version":"1","generated_at":"2026-04-22T22:59:04+00:00","cve":"CVE-2021-32675","urls":{"html":"https://cve.report/CVE-2021-32675","api":"https://cve.report/api/cve/CVE-2021-32675.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2021-32675","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-32675"},"summary":{"title":"CVE-2021-32675","description":"Redis is an open source, in-memory database that persists on disk. When parsing an incoming Redis Standard Protocol (RESP) request, Redis allocates memory according to user-specified values which determine the number of elements (in the multi-bulk header) and size of each element (in the bulk header). An attacker delivering specially crafted requests over multiple connections can cause the server to allocate significant amount of memory. Because the same parsing mechanism is used to handle authentication requests, this vulnerability can also be exploited by unauthenticated users. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14. An additional workaround to mitigate this problem without patching the redis-server executable is to block access to prevent unauthenticated users from connecting to Redis. This can be done in different ways: Using network access control tools like firewalls, iptables, security groups, etc. or Enabling TLS and requiring users to authenticate using client side certificates.","state":"PUBLIC","assigner":"security-advisories@github.com","published_at":"2021-10-04 18:15:00","updated_at":"2023-11-07 03:35:00"},"problem_types":["CWE-770"],"metrics":[],"references":[{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/","name":"FEDORA-2021-8913c7900c","refsource":"FEDORA","tags":[],"title":"[SECURITY] Fedora 33 Update: redis-6.0.16-1.fc33 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://security.gentoo.org/glsa/202209-17","name":"GLSA-202209-17","refsource":"GENTOO","tags":[],"title":"Redis: Multiple Vulnerabilities (GLSA 202209-17) — Gentoo security","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/","name":"FEDORA-2021-8913c7900c","refsource":"","tags":[],"title":"[SECURITY] Fedora 33 Update: redis-6.0.16-1.fc33 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.debian.org/security/2021/dsa-5001","name":"DSA-5001","refsource":"DEBIAN","tags":[],"title":"Debian -- Security Information -- DSA-5001-1 redis","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","name":"https://www.oracle.com/security-alerts/cpuapr2022.html","refsource":"MISC","tags":[],"title":"Oracle Critical Patch Update Advisory - April 2022","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/","name":"FEDORA-2021-aa94492a09","refsource":"FEDORA","tags":[],"title":"[SECURITY] Fedora 35 Update: redis-6.2.6-1.fc35 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/redis/redis/security/advisories/GHSA-f6pw-v9gw-v64p","name":"https://github.com/redis/redis/security/advisories/GHSA-f6pw-v9gw-v64p","refsource":"CONFIRM","tags":[],"title":"DoS vulnerability in Redis · Advisory · redis/redis · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.apache.org/thread.html/ra603ff6e04549d7f290f61f9b11e2d2e4dba693b05ff053f4ec6bc47%40%3Cnotifications.geode.apache.org%3E","name":"[geode-notifications] 20211013 [GitHub] [geode] jdeppe-pivotal opened a new pull request #6994: GEODE-9676: Limit array and string sizes for unauthenticated Radish connections","refsource":"","tags":[],"title":"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.apache.org/thread.html/ra603ff6e04549d7f290f61f9b11e2d2e4dba693b05ff053f4ec6bc47@%3Cnotifications.geode.apache.org%3E","name":"[geode-notifications] 20211013 [GitHub] [geode] jdeppe-pivotal opened a new pull request #6994: GEODE-9676: Limit array and string sizes for unauthenticated Radish connections","refsource":"MLIST","tags":[],"title":"Pony Mail!","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://security.netapp.com/advisory/ntap-20211104-0003/","name":"https://security.netapp.com/advisory/ntap-20211104-0003/","refsource":"CONFIRM","tags":[],"title":"October 2021 Redis Vulnerabilities in NetApp Products | NetApp Product Security","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/","name":"FEDORA-2021-aa94492a09","refsource":"","tags":[],"title":"[SECURITY] Fedora 35 Update: redis-6.2.6-1.fc35 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/redis/redis/commit/5674b0057ff2903d43eaff802017eddf37c360f8","name":"https://github.com/redis/redis/commit/5674b0057ff2903d43eaff802017eddf37c360f8","refsource":"MISC","tags":[],"title":"Prevent unauthenticated client from easily consuming lots of memory (… · redis/redis@5674b00 · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/","name":"FEDORA-2021-61c487f241","refsource":"","tags":[],"title":"[SECURITY] Fedora 34 Update: redis-6.2.6-1.fc34 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/","name":"FEDORA-2021-61c487f241","refsource":"FEDORA","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-32675","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32675","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2021","cve_id":"32675","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"10.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"32675","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"11.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"32675","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fedoraproject","cpe5":"fedora","cpe6":"33","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"32675","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fedoraproject","cpe5":"fedora","cpe6":"34","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"32675","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fedoraproject","cpe5":"fedora","cpe6":"35","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"32675","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"netapp","cpe5":"hci","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"32675","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"netapp","cpe5":"management_services_for_element_software","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"32675","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"netapp","cpe5":"management_services_for_netapp_hci","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"32675","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"communications_operations_monitor","cpe6":"4.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"32675","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"communications_operations_monitor","cpe6":"4.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"32675","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"communications_operations_monitor","cpe6":"5.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"32675","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redis","cpe5":"redis","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2021-32675","qid":"159435","title":"Oracle Enterprise Linux Security Update for redis:5 (ELSA-2021-3918)"},{"cve":"CVE-2021-32675","qid":"159436","title":"Oracle Enterprise Linux Security Update for redis:6 (ELSA-2021-3945)"},{"cve":"CVE-2021-32675","qid":"178879","title":"Debian Security Update for redis (DSA 5001-1)"},{"cve":"CVE-2021-32675","qid":"178883","title":"Debian Security Update for redis (DLA 2810-1)"},{"cve":"CVE-2021-32675","qid":"183640","title":"Debian Security Update for redis (CVE-2021-32675)"},{"cve":"CVE-2021-32675","qid":"239688","title":"Red Hat Update for redis:5 (RHSA-2021:3918)"},{"cve":"CVE-2021-32675","qid":"239725","title":"Red Hat Update for red hat openstack platform 13.0 (redis) (RHSA-2021:3980)"},{"cve":"CVE-2021-32675","qid":"239726","title":"Red Hat Update for red hat openstack platform 10.0 (redis) (RHSA-2021:3971)"},{"cve":"CVE-2021-32675","qid":"239727","title":"Red Hat Update for rh-redis5-redis (RHSA-2021:3947)"},{"cve":"CVE-2021-32675","qid":"239728","title":"Red Hat Update for redis:5 (RHSA-2021:3946)"},{"cve":"CVE-2021-32675","qid":"239731","title":"Red Hat Update for redis:5 (RHSA-2021:3944)"},{"cve":"CVE-2021-32675","qid":"239733","title":"Red Hat Update for redis:6 (RHSA-2021:3945)"},{"cve":"CVE-2021-32675","qid":"281978","title":"Fedora Security Update for redis (FEDORA-2021-61c487f241)"},{"cve":"CVE-2021-32675","qid":"281979","title":"Fedora Security Update for redis (FEDORA-2021-8913c7900c)"},{"cve":"CVE-2021-32675","qid":"356248","title":"Amazon Linux Security Advisory for redis : ALASREDIS6-2023-007"},{"cve":"CVE-2021-32675","qid":"376213","title":"Redis Server Heap Overflow Vulnerability"},{"cve":"CVE-2021-32675","qid":"500601","title":"Alpine Linux Security Update for redis"},{"cve":"CVE-2021-32675","qid":"501484","title":"Alpine Linux Security Update for redis"},{"cve":"CVE-2021-32675","qid":"501777","title":"Alpine Linux Security Update for redis"},{"cve":"CVE-2021-32675","qid":"504356","title":"Alpine Linux Security Update for redis"},{"cve":"CVE-2021-32675","qid":"710625","title":"Gentoo Linux Redis Multiple Vulnerabilities (GLSA 202209-17)"},{"cve":"CVE-2021-32675","qid":"730745","title":"Redis Server Multiple Vulnerabilities (GHSA-vw22-qm3h-49pr)"},{"cve":"CVE-2021-32675","qid":"751395","title":"OpenSUSE Security Update for redis (openSUSE-SU-2021:3772-1)"},{"cve":"CVE-2021-32675","qid":"900392","title":"Common Base Linux Mariner (CBL-Mariner) Security Update for redis (5968)"},{"cve":"CVE-2021-32675","qid":"900931","title":"Common Base Linux Mariner (CBL-Mariner) Security Update for redis (6848-1)"},{"cve":"CVE-2021-32675","qid":"940139","title":"AlmaLinux Security Update for redis:6 (ALSA-2021:3945)"},{"cve":"CVE-2021-32675","qid":"940141","title":"AlmaLinux Security Update for redis:5 (ALSA-2021:3918)"},{"cve":"CVE-2021-32675","qid":"960683","title":"Rocky Linux Security Update for redis:6 (RLSA-2021:3945)"},{"cve":"CVE-2021-32675","qid":"960717","title":"Rocky Linux Security Update for redis:5 (RLSA-2021:3918)"}]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security-advisories@github.com","ID":"CVE-2021-32675","STATE":"PUBLIC","TITLE":"DoS vulnerability in Redis"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"redis","version":{"version_data":[{"version_value":"< 5.0.14"},{"version_value":">= 6.0.0, < 6.0.16"},{"version_value":">= 6.2.0, < 6.2.6"}]}}]},"vendor_name":"redis"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Redis is an open source, in-memory database that persists on disk. When parsing an incoming Redis Standard Protocol (RESP) request, Redis allocates memory according to user-specified values which determine the number of elements (in the multi-bulk header) and size of each element (in the bulk header). An attacker delivering specially crafted requests over multiple connections can cause the server to allocate significant amount of memory. Because the same parsing mechanism is used to handle authentication requests, this vulnerability can also be exploited by unauthenticated users. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14. An additional workaround to mitigate this problem without patching the redis-server executable is to block access to prevent unauthenticated users from connecting to Redis. This can be done in different ways: Using network access control tools like firewalls, iptables, security groups, etc. or Enabling TLS and requiring users to authenticate using client side certificates."}]},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-770: Allocation of Resources Without Limits or Throttling"}]}]},"references":{"reference_data":[{"name":"https://github.com/redis/redis/security/advisories/GHSA-f6pw-v9gw-v64p","refsource":"CONFIRM","url":"https://github.com/redis/redis/security/advisories/GHSA-f6pw-v9gw-v64p"},{"name":"https://github.com/redis/redis/commit/5674b0057ff2903d43eaff802017eddf37c360f8","refsource":"MISC","url":"https://github.com/redis/redis/commit/5674b0057ff2903d43eaff802017eddf37c360f8"},{"refsource":"FEDORA","name":"FEDORA-2021-8913c7900c","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/"},{"refsource":"FEDORA","name":"FEDORA-2021-61c487f241","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/"},{"refsource":"MLIST","name":"[geode-notifications] 20211013 [GitHub] [geode] jdeppe-pivotal opened a new pull request #6994: GEODE-9676: Limit array and string sizes for unauthenticated Radish connections","url":"https://lists.apache.org/thread.html/ra603ff6e04549d7f290f61f9b11e2d2e4dba693b05ff053f4ec6bc47@%3Cnotifications.geode.apache.org%3E"},{"refsource":"FEDORA","name":"FEDORA-2021-aa94492a09","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/"},{"refsource":"DEBIAN","name":"DSA-5001","url":"https://www.debian.org/security/2021/dsa-5001"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","refsource":"MISC","name":"https://www.oracle.com/security-alerts/cpuapr2022.html"},{"refsource":"CONFIRM","name":"https://security.netapp.com/advisory/ntap-20211104-0003/","url":"https://security.netapp.com/advisory/ntap-20211104-0003/"},{"refsource":"GENTOO","name":"GLSA-202209-17","url":"https://security.gentoo.org/glsa/202209-17"}]},"source":{"advisory":"GHSA-f6pw-v9gw-v64p","discovery":"UNKNOWN"}},"nvd":{"publishedDate":"2021-10-04 18:15:00","lastModifiedDate":"2023-11-07 03:35:00","problem_types":["CWE-770"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL","baseScore":5},"severity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2.0","versionEndExcluding":"6.2.6","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.0","versionEndExcluding":"6.0.16","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0.0","versionEndExcluding":"5.0.14","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:netapp:management_services_for_netapp_hci:-:*:*:*:*:*:*:*","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:oracle:communications_operations_monitor:4.3:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:oracle:communications_operations_monitor:4.4:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:oracle:communications_operations_monitor:5.0:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2021","CveId":"32675","Ordinal":"208063","Title":"CVE-2021-32675","CVE":"CVE-2021-32675","Year":"2021"},"notes":[{"CveYear":"2021","CveId":"32675","Ordinal":"1","NoteData":"Redis is an open source, in-memory database that persists on disk. When parsing an incoming Redis Standard Protocol (RESP) request, Redis allocates memory according to user-specified values which determine the number of elements (in the multi-bulk header) and size of each element (in the bulk header). An attacker delivering specially crafted requests over multiple connections can cause the server to allocate significant amount of memory. Because the same parsing mechanism is used to handle authentication requests, this vulnerability can also be exploited by unauthenticated users. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14. An additional workaround to mitigate this problem without patching the redis-server executable is to block access to prevent unauthenticated users from connecting to Redis. This can be done in different ways: Using network access control tools like firewalls, iptables, security groups, etc. or Enabling TLS and requiring users to authenticate using client side certificates.","Type":"Description","Title":null},{"CveYear":"2021","CveId":"32675","Ordinal":"2","NoteData":"2021-10-04","Type":"Other","Title":"Published"},{"CveYear":"2021","CveId":"32675","Ordinal":"3","NoteData":"2021-11-06","Type":"Other","Title":"Modified"}]}}}