CVE-2022-35977: Redis

Medium severity, CVSS 5.5. EPSS: 13.5% chance of exploitation in the next 30 days.

Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SETRANGE` and `SORT(_RO)` commands can trigger an integer overflow, resulting with Redis attempting to allocate impossible amounts of memory and abort with an out-of-memory (OOM) panic. The problem is fixed in Redis versions 7.0.8, 6.2.9 and 6.0.17. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

• Redis Redis: from 6.0.0, before 6.0.17 (fixed in 6.0.17); from 6.2.0, before 6.2.9 (fixed in 6.2.9); from 7.0.0, before 7.0.8 (fixed in 7.0.8)

Published 2023-01-20. Last modified 2026-06-17.