CVE-2021-29477

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer could be exploited using the `STRALGO LCS` command to corrupt the heap and potentially result with remote code execution. The problem is fixed in version 6.2.3 and 6.0.13. An additional workaround to mitigate the problem without patching the redis-server executable is to use ACL configuration to prevent clients from using the `STRALGO LCS` command.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
redis	redis	>= 6.2.0, < 6.2.3; >= 6.0.0, < 6.0.13

References

Timeline

Published: May 4, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-294788.8Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow b CVE-2021-294796.1Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, a user supplied `X-Forwarded-Host` header can be used to per CVE-2021-294803.1Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the client side session module uses the application startup CVE-2021-294817.5Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the default configuration of client side sessions results in CVE-2021-294827.5xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the CVE-2021-294837.5ManageWiki is an extension to the MediaWiki project. The 'wikiconfig' API leaked the value of private configuration variables set through th CVE-2021-294846.8Ghost is a Node.js CMS. An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access CVE-2021-294858.8Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, a malicious attacker can achieve Remote Code Execution (RCE)CVE-2021-294867.5cumulative-distribution-function is an open source npm library used which calculates statistical cumulative distribution function from data CVE-2021-294877.4octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can exploit CVE-2021-294885.3SABnzbd is an open source binary newsreader. A vulnerability was discovered in SABnzbd that could trick the `filesystem.renamer()` function CVE-2021-294895.4Highcharts JS is a JavaScript charting library based on SVG. In Highcharts versions 8 and earlier, the chart options structure was not syste