CVE & CISA-KEV Catalog

CVE-2021-32626

HIGHEPSS 96th pctl
7.5
CVSS v3
NVD

Description

Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted Lua scripts executing in Redis can cause the heap-based Lua stack to be overflowed, due to incomplete checks for this condition. This can result with heap corruption and potentially remote code execution. This problem exists in all versions of Redis with Lua scripting support, starting from 2.6. The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14. For users unable to update an additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

CWE-122Heap-based Buffer OverflowCWE-787Out-of-bounds Write

How to fix

Remediation Available
redisDebian
Fixed in:5:6.0.16-1+deb11u1CVE-2021-32626
Fixed in:5:6.0.16-1CVE-2021-32626
Fixed in:5:6.0.16-1CVE-2021-32626
Fixed in:5:6.0.16-1CVE-2021-32626
redisUbuntu
Fixed in:2:2.8.4-2ubuntu0.2+esm2USN-5221-1
Fixed in:2:3.0.6-1ubuntu0.4+esm1USN-5221-1
Fixed in:5:4.0.9-1ubuntu0.2+esm3USN-5221-1
Fixed in:5:5.0.7-2ubuntu0.1+esm1USN-5221-1
redis-serverUbuntu
Fixed in:2:2.8.4-2ubuntu0.2+esm2USN-5221-1
Fixed in:2:3.0.6-1ubuntu0.4+esm1USN-5221-1
redis-toolsUbuntu
Fixed in:2:2.8.4-2ubuntu0.2+esm2USN-5221-1
Fixed in:2:3.0.6-1ubuntu0.4+esm1USN-5221-1
Fixed in:5:4.0.9-1ubuntu0.2+esm3USN-5221-1
Fixed in:5:5.0.7-2ubuntu0.1+esm1USN-5221-1
Redis on WindowsWindows application
Affected:2.6 5.0.14Fixed in:5.0.14MSOpenTech
Affected:6.0.0 6.0.16Fixed in:6.0.16MSOpenTech
Affected:6.2.0 6.2.6Fixed in:6.2.6MSOpenTech

TridentStack Control can deploy fixes like this automatically across your Windows, macOS, and Linux fleet. See how it works

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorNetwork
Attack ComplexityHigh
Privileges RequiredLow
User InteractionNone
ScopeUnchanged

Impact

ConfidentialityHigh
IntegrityHigh
AvailabilityHigh

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploit Intelligence

15.13%probability of exploitation in 30 days
96thpercentile

Very high risk: more likely to be exploited than 96% of all known CVEs.

References

Related Vulnerabilities

Other CWE-122 (Heap-based Buffer Overflow) vulnerabilities, ordered by exploit likelihood. View all

CVESeverityCVSSEPSSExploitedFix
CVE-2015-3113Critical9.8100%KEVFix
CVE-2024-26256High7.888%-Fix
CVE-2020-25687Medium5.987%-Fix
CVE-2009-3459High8.887%KEVFix
CVE-2021-21017High8.886%KEV-
CVE-2020-25683Medium5.986%-Fix
Embed a live status badge for CVE-2021-32626
CVE-2021-32626 severity badge

Markdown

[![CVE-2021-32626](https://tridentstack.com/cve/badge/CVE-2021-32626.svg)](https://tridentstack.com/cve/CVE-2021-32626)

HTML

<a href="https://tridentstack.com/cve/CVE-2021-32626"><img src="https://tridentstack.com/cve/badge/CVE-2021-32626.svg" alt="CVE-2021-32626"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

See how it worksStart freeThis CVE lookup is free and always will be.

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2024-11-21.