CVE-2021-32762 — Integer Overflow or Wraparound

Vendor	Product	Version range	Fixed in
debian	debian_linux	—	—
debian	debian_linux	—	—
debian	redis	< redis 5:6.0.16-1 (bookworm)	redis 5:6.0.16-1 (bookworm)
fedoraproject	fedora	—	—
fedoraproject	fedora	—	—
fedoraproject	fedora	—	—
msrc	cbl2_redis_6.2.6-1_on_cbl_mariner_2.0	—	—
msrc	cm1_redis_5.0.14-1_on_cbl_mariner_1.0	—	—
oracle	communications_operations_monitor	—	—
oracle	communications_operations_monitor	—	—
oracle	communications_operations_monitor	—	—
redis	redis	< 5.0.14	5.0.14
redis	redis	—	—
redis	redis	—	—
redis	redis	>= 0 < 5:6.0.16-1+deb11u1	5:6.0.16-1+deb11u1
redis	redis	>= 0 < 5:6.0.16-1	5:6.0.16-1
redis	redis	>= 0 < 5:6.0.16-1	5:6.0.16-1
redis	redis	>= 0 < 5:6.0.16-1	5:6.0.16-1
redis	redis	>= 5.0.0 < 5.0.14	5.0.14
redis	redis	>= 6.0.0 < 6.0.16	6.0.16
redis	redis	>= 6.2.0 < 6.2.6	6.2.6

OSV

CVE-2021-32762: Redis is an open source, in-memory database that persists on disk

osv·2021-10-04·CVSS 8.8

CVE-2021-32762 [HIGH] CVE-2021-32762: Redis is an open source, in-memory database that persists on disk Redis is an open source, in-memory database that persists on disk. The redis-cli command line tool and redis-sentinel service may be vulnerable to integer overflow when parsing specially crafted large multi-bulk network replies. This is a result of a vulnerability in the underlying hiredis library which does not perform an overflow check before calling the calloc() heap allocation function. This issue only impacts systems with heap allocators that do not perform their own overflow checks. Most modern systems do and are therefore not likely to be affected. Furthermore, by default redis-sentinel uses the jemalloc allocator which is also not vulnerable. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14.

Microsoft

Integer overflow that can lead to heap overflow in redis-cli redis-sentinel on some platforms

vendor_msrc·2021-10-12·CVSS 8.8

CVE-2021-32762 [HIGH] CWE-190 Integer overflow that can lead to heap overflow in redis-cli redis-sentinel on some platforms Integer overflow that can lead to heap overflow in redis-cli redis-sentinel on some platforms FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this. Mariner: Mariner GitHub_M: GitHub_M Customer Action Required: Yes Remediation: CB

Red Hat

redis: Integer overflow in redis-cli, redis-sentinel on some platforms

vendor_redhat·2021-10-04·CVSS 7.5

CVE-2021-32762 [HIGH] CWE-190 redis: Integer overflow in redis-cli, redis-sentinel on some platforms redis: Integer overflow in redis-cli, redis-sentinel on some platforms Redis is an open source, in-memory database that persists on disk. The redis-cli command line tool and redis-sentinel service may be vulnerable to integer overflow when parsing specially crafted large multi-bulk network replies. This is a result of a vulnerability in the underlying hiredis library which does not perform an overflow check before calling the calloc() heap allocation function. This issue only impacts systems with heap allocators that do not perform their own overflow checks. Most modern systems do and are therefore not likely to be affected. Furthermore, by default redis-sentinel uses the jemalloc allocator which is also not vulnerable. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14. An

Debian

CVE-2021-32762: redis - Redis is an open source, in-memory database that persists on disk. The redis-cli...

vendor_debian·2021·CVSS 7.5

CVE-2021-32762 [HIGH] CVE-2021-32762: redis - Redis is an open source, in-memory database that persists on disk. The redis-cli... Redis is an open source, in-memory database that persists on disk. The redis-cli command line tool and redis-sentinel service may be vulnerable to integer overflow when parsing specially crafted large multi-bulk network replies. This is a result of a vulnerability in the underlying hiredis library which does not perform an overflow check before calling the calloc() heap allocation function. This issue only impacts systems with heap allocators that do not perform their own overflow checks. Most modern systems do and are therefore not likely to be affected. Furthermore, by default redis-sentinel uses the jemalloc allocator which is also not vulnerable. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14. Scope: local bookworm: resolved (fixed in 5:6.0.16-1) bullseye: resolved (fi

CVE-2021-32762: Redis is an open source, in-memory database that persists on disk. The redis-cli command line tool and redis-sentinel service may be vulnerable to integer…

Affected

CVSS provenance