CVE-2022-35951

Description

Redis is an in-memory database that persists on disk. Versions 7.0.0 and above, prior to 7.0.5 are vulnerable to an Integer Overflow. Executing an `XAUTOCLAIM` command on a stream key in a specific state, with a specially crafted `COUNT` argument may cause an integer overflow, a subsequent heap overflow, and potentially lead to remote code execution. This has been patched in Redis version 7.0.5. No known workarounds exist.

How to fix CVE-2022-35951

To remediate CVE-2022-35951, upgrade the affected package to a fixed version below.

—upgrade to 7.0.5-r0 or later
—upgrade to 7.0.5 or later
—upgrade to 7.0.5 or later
—upgrade to 7.0.5 or later
—upgrade to 5:7.0.5-1 or later

Is CVE-2022-35951 being exploited?

Moderate — EPSS is 36.9%. Track this CVE but it's not at the top of the prioritisation list.

Affected packages (5)

from 0, < 7.0.5-r0
>= 7.0.0, < 7.0.5
>= 7.0.0, < 7.0.5
>= 7.0.0, < 7.0.5
from 0, < 5:7.0.5-1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H