PT-2023-1718 · Redis+10 · Redis+10
Tom Levy
·
Published
2023-02-28
·
Updated
2025-10-21
·
CVE-2022-36021
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Redis versions prior to 6.0.18
Redis versions prior to 6.2.11
Redis versions prior to 7.0.9
Description
Redis is an in-memory database that persists on disk. Authenticated users can use string matching commands (like
SCAN or KEYS) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time.Recommendations
Update to Redis version 6.0.18 or later for versions prior to 6.0.18.
Update to Redis version 6.2.11 or later for versions prior to 6.2.11.
Update to Redis version 7.0.9 or later for versions prior to 7.0.9.
As a temporary workaround, consider restricting the use of
SCAN and KEYS commands with specially crafted patterns until a patch is available.Exploit
Fix
DoS
Integer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Red Hat
Red Os
Redis
Rocky Linux
Suse
Ubuntu