CVE-2022-36021

2023-03-0116:15:09

Google

osv.dev

6.2 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

8.7%

JSON

Redis is an in-memory database that persists on disk. Authenticated users can use string matching commands (like SCAN or KEYS) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. The problem is fixed in Redis versions 6.0.18, 6.2.11, 7.0.9.

CPENameOperatorVersion
rediseq2.2-alpha6
rediseq2.2-alpha5
rediseq2.1.1-watch
rediseq2.2-alpha2
rediseqm-playpen
rediseqwith-deprecated-diskstore
rediseq2.2.0-rc1
rediseq1.3.6
rediseq1.3.7
rediseq2.2-alpha4

Name	Operator	Version
redis	eq	2.2-alpha6
redis	eq	2.2-alpha5
redis	eq	2.1.1-watch
redis	eq	2.2-alpha2
redis	eq	m-playpen
redis	eq	with-deprecated-diskstore
redis	eq	2.2.0-rc1
redis	eq	1.3.6
redis	eq	1.3.7
redis	eq	2.2-alpha4