Unrated severityNVD Advisory· Published Sep 23, 2022· Updated Apr 23, 2025
Redis subject to Integer Overflow leading to Remote Code Execution via Heap Overflow
CVE-2022-35951
Description
Redis is an in-memory database that persists on disk. Versions 7.0.0 and above, prior to 7.0.5 are vulnerable to an Integer Overflow. Executing an XAUTOCLAIM command on a stream key in a specific state, with a specially crafted COUNT argument may cause an integer overflow, a subsequent heap overflow, and potentially lead to remote code execution. This has been patched in Redis version 7.0.5. No known workarounds exist.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
6- osv-coords4 versionspkg:bitnami/keydbpkg:bitnami/redispkg:bitnami/valkeypkg:rpm/opensuse/redis&distro=openSUSE%20Tumbleweed
>= 7.0.0, < 7.0.5+ 3 more
- (no CPE)range: >= 7.0.0, < 7.0.5
- (no CPE)range: >= 7.0.0, < 7.0.5
- (no CPE)range: >= 7.0.0, < 7.0.5
- (no CPE)range: < 7.0.5-1.1
Patches
Vulnerability mechanics
References
4- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A7INCOOFPPEAKNDBZU3TIZJPYXBULI2C/mitrevendor-advisory
- security.gentoo.org/glsa/202209-17mitrevendor-advisory
- github.com/redis/redis/security/advisories/GHSA-5gc4-76rx-22c9mitre
- security.netapp.com/advisory/ntap-20221020-0005/mitre
News mentions
0No linked articles in our index yet.