Medium severity · published Mar 31, 2021
CVE-2021-3470
A heap overflow issue was found in Redis in versions before 5.0.10, before 6.0.9 and before 6.2.0 when using a heap allocator other than jemalloc or glibc's malloc, leading to…
5.3
CVSS
1.1%
EPSS
No
On KEV
Description
A heap overflow issue was found in Redis in versions before 5.0.10, before 6.0.9 and before 6.2.0 when using a heap allocator other than jemalloc or glibc's malloc, leading to potential out of bound write or process crash. Effectively this flaw does not affect the vast majority of users, who use jemalloc or glibc malloc.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
Redis · Redis
before 5.0.10; 6.0.0 before 6.0.9; 6.2.0; 6.2.0; 6.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-3470
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-3470
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1943623
More from Redis
10.0
CVE-2022-0543
Debian-specific Redis Server Lua Sandbox Escape Vulnerability
9.9
CVE-2025-49844
Redis Lua Use-After-Free may lead to remote code execution
9.8
CVE-2025-27151
redis-check-aof may lead to stack overflow and potential RCE
9.8
CVE-2024-46981
Redis' Lua library commands may lead to remote code execution
9.8
CVE-2022-3734
Redis on Windows dbghelp.dll uncontrolled search path