CVE-2021-32626

mediumpriority · track · 41EPSS 0.162 · 97 %ileDEEURUUS
grimoire priorityP1 · Urgent
Exploitable?
—
no known exploitation
Likely / severe?
16.2% (97th) EPSS
CVSS 6.5 · medium
Is it mine?
45 products
Check your exposure
Who says so?
5 sources
cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted Lua scripts executing in Redis can cause the heap-based Lua stack to be overflowed, due to incomplete checks for this condition. This can result with heap corruption and potentially remote code execution. This problem exists in all versions of Redis with Lua scripting support, starting from 2.6. The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14. For users unable to update an additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

01

cvss

Technical severity, 0–10. One row per scoring source.

8.8
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.5–8.8

v2.06.5mediumAV:N/AC:L/Au:S/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 8 · impact 6.4
v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 2.8 · impact 5.9
v3.17.5highAV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU
v3.17.5highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU
v3.17.5highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · security-advisories@github.comexploitability 1.6 · impact 5.9
v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
02

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-787USprimaryCWE-122USCWE-122USCWE-787US
03

affected products (45)

Products and version ranges known to be affected.

showing 20 of 45
04

advisories (4)

Vendor and ecosystem advisories describing this.

  • WID-SEC-W-2022-1579Redis: Mehrere SchwachstellenDeutsch2021-10-04csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Redis ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuführen.

  • BIT-keydb-2021-32626Lua scripts can overflow the heap-based Lua stack in Redis2024-08-22vendor · osvUS

    Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted Lua scripts executing in Redis can cause the heap-based Lua stack to be overflowed, due to incomplete checks for this condition. This can result with heap corruption and potentially remote code execution. This problem exists in all versions of Redis with Lua scripting support, starting from 2.6. The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14. For users unable to update an additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

  • BIT-redis-2021-32626Lua scripts can overflow the heap-based Lua stack in Redis2024-03-06vendor · osvUS

    Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted Lua scripts executing in Redis can cause the heap-based Lua stack to be overflowed, due to incomplete checks for this condition. This can result with heap corruption and potentially remote code execution. This problem exists in all versions of Redis with Lua scripting support, starting from 2.6. The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14. For users unable to update an additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

  • BIT-valkey-2021-32626Lua scripts can overflow the heap-based Lua stack in Redis2024-08-22vendor · osvUS

    Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted Lua scripts executing in Redis can cause the heap-based Lua stack to be overflowed, due to incomplete checks for this condition. This can result with heap corruption and potentially remote code execution. This problem exists in all versions of Redis with Lua scripting support, starting from 2.6. The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14. For users unable to update an additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

05

also known as (7)

Other names and identifiers for this entity.

06

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bduosvcert_bundNVDCVE.orgMITRE
published 2021-10-04modified 2026-06-17
08

references (55)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan