High severity7.0NVD Advisory· Published Sep 23, 2022· Updated Jun 17, 2026
CVE-2022-35951
CVE-2022-35951
Description
Redis is an in-memory database that persists on disk. Versions 7.0.0 and above, prior to 7.0.5 are vulnerable to an Integer Overflow. Executing an XAUTOCLAIM command on a stream key in a specific state, with a specially crafted COUNT argument may cause an integer overflow, a subsequent heap overflow, and potentially lead to remote code execution. This has been patched in Redis version 7.0.5. No known workarounds exist.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
8- osv-coords4 versionspkg:rpm/opensuse/redis&distro=openSUSE%20Tumbleweedpkg:bitnami/redispkg:bitnami/valkeypkg:bitnami/keydb
< 7.0.5-1.1+ 3 more
- (no CPE)range: < 7.0.5-1.1
- (no CPE)range: >= 7.0.0, < 7.0.5
- (no CPE)range: >= 7.0.0, < 7.0.5
- (no CPE)range: >= 7.0.0, < 7.0.5
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
4- github.com/redis/redis/security/advisories/GHSA-5gc4-76rx-22c9nvdThird Party Advisory
- security.gentoo.org/glsa/202209-17nvdThird Party Advisory
- security.netapp.com/advisory/ntap-20221020-0005/nvdThird Party Advisory
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A7INCOOFPPEAKNDBZU3TIZJPYXBULI2C/nvd
News mentions
0No linked articles in our index yet.