CVE-2022-36021

Published: Mar 1, 2023Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

Redis is an in-memory database that persists on disk. Authenticated users can use string matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. The problem is fixed in Redis versions 6.0.18, 6.2.11, 7.0.9.

Affected (3)

Products: Redis: Redis

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Redis Redis	Before 6.0.18
Redis Redis	From 6.2.0 to 6.2.11
Redis Redis	From 7.0.0 to 7.0.9

Related CWEs

Inefficient Algorithmic Complexity

An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

References (4)

https://github.com/redis/redis/commit/dcbfcb916ca1a269b3feef86ee86835294758f84

Source: security-advisories@github.com

Patch

https://github.com/redis/redis/security/advisories/GHSA-jr7j-rfj5-8xqv

Source: security-advisories@github.com

Vendor Advisory

https://github.com/redis/redis/commit/dcbfcb916ca1a269b3feef86ee86835294758f84

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/redis/redis/security/advisories/GHSA-jr7j-rfj5-8xqv

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.