QwikSec

Security Database

CVE

CWE

Training

CVE-2022-35977

Published: Jan 20, 2023

Modified: Nov 3, 2025

PUBLISHED

CVSS v3.1

5.5

MEDIUM

Description

Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SETRANGE` and `SORT(_RO)` commands can trigger an integer overflow, resulting with Redis attempting to allocate impossible amounts of memory and abort with an out-of-memory (OOM) panic. The problem is fixed in Redis versions 7.0.8, 6.2.9 and 6.0.17. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Vendor	Product	Versions
redis	redis	affected `>= 7.0, < 7.0.8` affected `>= 6.2, < 6.2.9` affected `< 6.0.17`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

References

https://github.com/redis/redis/security/advisories/GHSA-mrcw-fhw9-fj8j

x_refsource_CONFIRM

https://github.com/redis/redis/commit/1ec82e6e97e1db06a72ca505f9fbf6b981f31ef7

x_refsource_MISC

https://github.com/redis/redis/releases/tag/6.0.17

x_refsource_MISC

https://github.com/redis/redis/releases/tag/6.2.9

x_refsource_MISC

https://github.com/redis/redis/releases/tag/7.0.8

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.