What’s Vulnerable › Vulnerabilities

CVE-2021-32672: Vulnerability in Lua Debugger in Redis

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-10-04 · updated 2026-06-17
• Weakness: CWE-125

Description

Redis is an open source, in-memory database that persists on disk. When using the Redis Lua Debugger, users can send malformed requests that cause the debugger’s protocol parser to read data beyond the actual buffer. This issue affects all versions of Redis with Lua debugging support (3.2 or newer). The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14.

Affected products

• Debian Linux: 10.0, 11.0
• Fedoraproject Fedora: 33, 34, 35
• NetApp Management Services For Element Software: all versions
• NetApp Management Services For Netapp Hci: all versions
• Oracle Corporation Communications Operations Monitor: 4.3, 4.4, 5.0
• Red Hat Enterprise Linux: 8.0
• RedHat Software Collections: all versions
• Redis: from 3.2.0 before 5.0.14; from 6.0.0 before 6.0.16; from 6.2.0 before 6.2.6 — fixed in 5.0.14, 6.0.16, 6.2.6

How to fix

Upgrade to a fixed version: Redis 5.0.14, 6.0.16, 6.2.6. Check the vendor advisory for mitigations.

References

• https://github.com/redis/redis/commit/6ac3c0b7abd35f37201ed2d6298ecef4ea1ae1dd
• https://github.com/redis/redis/security/advisories/GHSA-9mj9-xx53-qmxm
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/
• https://security.gentoo.org/glsa/202209-17
• https://security.netapp.com/advisory/ntap-20211104-0003/
• https://www.debian.org/security/2021/dsa-5001
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://github.com/redis/redis/commit/6ac3c0b7abd35f37201ed2d6298ecef4ea1ae1dd
• https://github.com/redis/redis/security/advisories/GHSA-9mj9-xx53-qmxm
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/

Get alerted when CVE-2021-32672 or the next vulnerability affects your stack