Skip to content
Fencer Vulns
high 7.5

CVE-2021-32761 in the critical feed json

Integer overflow issues with *BIT commands on 32-bit systems

published 2021-07-21 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-19529 , GHSA-8wxq-j7rp-g8wj

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
30.1%
EPSS 30.1% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known

Summary

Redis is an in-memory database that persists on disk. A vulnerability involving out-of-bounds read and integer overflow to buffer overflow exists starting with version 2.2 and prior to versions 5.0.13, 6.0.15, and 6.2.5. On 32-bit systems, Redis `*BIT*` command are vulnerable to integer overflow that can potentially be exploited to corrupt the heap, leak arbitrary heap contents or trigger remote code execution. The vulnerability involves changing the default `proto-max-bulk-len` configuration parameter to a very large value and constructing specially crafted commands bit commands. This problem only affects Redis on 32-bit platforms, or compiled as a 32-bit binary. Redis versions 5.0.`3m 6.0.15, and 6.2.5 contain patches for this issue. An additional workaround to mitigate the problem without patching the `redis-server` executable is to prevent users from modifying the `proto-max-bulk-len` configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.

Patch / fix

  • redislabs redis 5.0.13, 6.0.15, 6.2.5
  • redis Debian 14, Debian 13, Debian 12 5:6.0.15-1

debian advisories DEBIAN-CVE-2021-32761

  • redis Ubuntu Pro 14.04 LTS 2:2.8.4-2ubuntu0.2+esm2
  • redis Ubuntu Pro 16.04 LTS 2:3.0.6-1ubuntu0.4+esm1
  • redis Ubuntu Pro 18.04 LTS 5:4.0.9-1ubuntu0.2+esm3

ubuntu advisories UBUNTU-CVE-2021-32761

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • redis openSUSE Tumbleweed 6.2.5-1.2

opensuse advisories openSUSE-SU-2024:11299-1

  • redis Alpine 3.12, Alpine 3.11 5.0.13-r0
  • redis Alpine 3.13 6.0.13-r0
  • redis Alpine 3.24, Alpine 3.23, Alpine 3.22 +8 more 6.2.5-r0

alpine advisories ALPINE-CVE-2021-32761

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • redis CBL-Mariner 2.0 6.2.5-1

azure linux advisories AZL-6850

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-32761 updated cvss 7.5

redis: integer overflow issues with BITFIELD command on 32-bit systems

  • Red Hat Advanced Cluster Management for Kubernetes 2 redisgraph-tls Red Hat Ansible Automation Platform 1.2 redis Red Hat Ansible Tower 3 redis Red Hat Enterprise Linux 8 redis Red Hat Enterprise Linux 9 redis Red Hat OpenStack Platform 10 (Newton) redis
    +1 more products
    Red Hat OpenStack Platform 13 (Queens) redis
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

30.10% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.0 AV:N/AC:M/Au:S/C:P/I:P/A:P

Affected products

  • redis redis

Classification

Weakness
  • CWE-125 Out-of-bounds Read
  • CWE-680 Integer Overflow to Buffer Overflow
  • CWE-190 Integer Overflow or Wraparound
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of redis/redis published their own advisory on GitHub. Reviewed sources take precedence over it.