Redis v7.0 was discovered to contain a memory leak via the component streamGetEdgeID.

published 2022-06-22 4 y ago modified 2026-09-08 2 mo ago also BIT-keydb-2022-33105 , BIT-redis-2022-33105 , BIT-valkey-2022-33105 , EUVD-2022-0268

cvss: 7.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 3.1%; EPSS 3.1% chance of exploitation in 30 days, percentile 87%
public exploits: 0; none known

Patch / fix

fixed in 3 links 2

bitnami keydb 7.0.1
bitnami redis 7.0.1
bitnami valkey 7.0.1

github.com/redis/redis@4a7a4e4 commit
github.com/redis/redis#10753 pull request

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-33105 updated 2026-11-04 cvss 7.5

redis: memory leak via streamGetEdgeID

Red Hat 3scale API Management Platform 2 system-rhel7-img system-rhel7-img Red Hat OpenShift Container Platform 4 openshift4/ose-cluster-monitoring-rhel9-operator
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

3.09% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/redis/redis/pull/10753 referenced PoC, tagged "exploit" by a source, unverified
github.com https://github.com/redis/redis/pull/10829 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:N/I:N/A:P
OSV	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
bitnami	keydb	>=7.0.0, <7.0.1	7.0.1
bitnami	redis	>=7.0.0, <7.0.1	7.0.1
bitnami	valkey	>=7.0.0, <7.0.1	7.0.1

Classification

Weakness

CWE-401 Missing Release of Memory after Effective Lifetime

Technology feeds

Redis rss critical rss

References

github.com /redis/redis/commit/4a7a4e42db8ff757cdf3f4a824f66426036034ef
patch, third-party-advisory, advisory, web
github.com /redis/redis/pull/10753
exploit, issue-tracking, patch, third-party-advisory, advisory, web
github.com /redis/redis/pull/10829
exploit, issue-tracking, release-notes, third-party-advisory, advisory, web
security.gentoo.org /glsa/202209-17
vendor-advisory, third-party-advisory, advisory, web
raw.githubusercontent.com /redis/redis/7.0.1/00-RELEASENOTES
release-notes, third-party-advisory, advisory, web
security.netapp.com /advisory/ntap-20220729-0005/
third-party-advisory, advisory, web
nvd.nist.gov /vuln/detail/CVE-2022-33105
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary