CVE-2021-32625

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer, could be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. This is a result of an incomplete fix by CVE-2021-29477. The problem is fixed in version 6.2.4 and 6.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to use ACL configuration to prevent clients from using the STRALGO LCS command. On 64 bit systems which have the fixes of CVE-2021-29477 (6.2.3 or 6.0.13), it is sufficient to make sure that the proto-max-bulk-len config parameter is smaller than 2GB (default is 512MB).

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-680 CWE-190

Affected software

No affected versions have been published.

Timeline

Published: Jun 2, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-326268.8Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted Lua scripts executing in Redis can CVE-2021-326277.5Redis is an open source, in-memory database that persists on disk. In affected versions an integer overflow bug in Redis can be exploited to CVE-2021-326287.5Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the ziplist data structure used by all version CVE-2021-326298.8Cranelift is an open-source code generator maintained by Bytecode Alliance. It translates a target-independent intermediate representation i CVE-2021-326308.8Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.0.4, there is an CVE-2021-326316.5Common is a package of common modules that can be accessed by NIMBLE services. Common before commit number 3b96cb0293d3443b870351945f41d7d55 CVE-2021-326324.3Pajbot is a Twitch chat bot. Pajbot versions prior to 1.52 are vulnerable to cross-site request forgery (CSRF). Hosters of the bot should up CVE-2021-326338.8Zope is an open-source web application server. In Zope versions prior to 4.6 and 5.2, users can access untrusted modules indirectly through CVE-2021-326347.2Emissary is a distributed, peer-to-peer, data-driven workflow framework. Emissary 6.4.0 is vulnerable to Unsafe Deserialization of post-auth CVE-2021-326356.3Singularity is an open source container platform. In verions 3.7.2 and 3.7.3, Dde to incorrect use of a default URL, `singularity` action co CVE-2021-3263710.0Authelia is a a single sign-on multi-factor portal for web apps. This affects uses who are using nginx ngx_http_auth_request_module with Aut CVE-2021-326384.4Github's CodeQL action is provided to run CodeQL-based code scanning on non-GitHub CI/CD systems and requires a GitHub access token to conne