redis: Integer overflow issue with strings

🗓️ 20 Oct 2021 14:24:32Reported by RedHatType

Redis integer overflow in the string library allows a remote attacker to corrupt the heap and potentially execute code via large maximum bulk length payloads.

Reporter	Title	Published	Views	Family All 176
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Redis affecting the IBM Event Streams UI	21 Dec 202117:42	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Redis may affect IBM Robotic Process Automation for Cloud Pak	27 Jun 202319:31	–	ibm
IBM Security Bulletins	Security Bulletin: Mutiple Vulnerabilities in Redis affecting Watson Knowledge Catalog for IBM Cloud Pak for Data	22 Jun 202209:58	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Redis, OpenSSH, Golang Go, and Apache Kafka may affect IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes and OpenShift	10 Dec 202121:55	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak	6 Oct 202204:10	–	ibm
FreeBSD	redis -- multiple vulnerabilities	4 Oct 202100:00	–	freebsd
ATTACKERKB	CVE-2021-41099	4 Oct 202118:15	–	attackerkb
Tenable Nessus	Amazon Linux 2 : redis (ALASREDIS6-2023-007)	27 Sep 202300:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0157: redis:6 (ALINUX3-SA-2023:0157)	14 May 202500:00	–	nessus
Tenable Nessus	CentOS 8 : redis:5 (CESA-2021:3918)	28 Oct 202100:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8.4	aarch64	redis	6.0.9-5.module+el8.4.0+12929+1bb0d2aa	redis-6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64.rpm
Red Hat Enterprise Linux	8.4	ppc64le	redis	6.0.9-5.module+el8.4.0+12929+1bb0d2aa	redis-6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le.rpm
Red Hat Enterprise Linux	8.4	s390x	redis	6.0.9-5.module+el8.4.0+12929+1bb0d2aa	redis-6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x.rpm
Red Hat Enterprise Linux	8.4	x86_64	redis	6.0.9-5.module+el8.4.0+12929+1bb0d2aa	redis-6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64.rpm
Red Hat Enterprise Linux	8.4	aarch64	redis-debuginfo	6.0.9-5.module+el8.4.0+12929+1bb0d2aa	redis-debuginfo-6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64.rpm
Red Hat Enterprise Linux	8.4	ppc64le	redis-debuginfo	6.0.9-5.module+el8.4.0+12929+1bb0d2aa	redis-debuginfo-6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le.rpm
Red Hat Enterprise Linux	8.4	s390x	redis-debuginfo	6.0.9-5.module+el8.4.0+12929+1bb0d2aa	redis-debuginfo-6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x.rpm
Red Hat Enterprise Linux	8.4	x86_64	redis-debuginfo	6.0.9-5.module+el8.4.0+12929+1bb0d2aa	redis-debuginfo-6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64.rpm
Red Hat Enterprise Linux	8.4	aarch64	redis-debugsource	6.0.9-5.module+el8.4.0+12929+1bb0d2aa	redis-debugsource-6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64.rpm
Red Hat Enterprise Linux	8.4	ppc64le	redis-debugsource	6.0.9-5.module+el8.4.0+12929+1bb0d2aa	redis-debugsource-6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2021-41099
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/redis/redis/security/advisories/GHSA-j3cr-9h5g-6cph
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-41099
cve	www.cve.org/CVERecord

04 Aug 2026 11:48Current

7.7High risk

Vulners AI Score7.7

CVSS 26

CVSS 3.17.5

EPSS0.03678

CWE-190