PT-2021-4401 · Redis+9 · Redis+9
Published
2021-10-04
·
Updated
2026-05-18
·
CVE-2021-32626
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Redis versions 2.6 through 6.2.5
Redis versions 6.0.0 through 6.0.15
Redis versions 5.0.0 through 5.0.13
Description
The issue is related to the Lua scripting support in Redis, where specially crafted Lua scripts can cause a heap-based Lua stack overflow due to incomplete checks. This can result in heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6.
Recommendations
For versions 2.6 through 6.2.5, update to version 6.2.6 or later.
For versions 6.0.0 through 6.0.15, update to version 6.0.16 or later.
For versions 5.0.0 through 5.0.13, update to version 5.0.14 or later.
As a temporary workaround for users unable to update, prevent users from executing Lua scripts by using ACL to restrict
EVAL and EVALSHA commands.Fix
RCE
Heap Based Buffer Overflow
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Red Hat
Redis
Rocky Linux
Suse
Ubuntu