Skip to content
Fencer Intel
medium 5.5

CVE-2022-35977 json

Integer overflow in certain command arguments can drive Redis to OOM panic

published 3y ago modified 2mo ago also BIT-keydb-2022-35977 , BIT-redis-2022-35977 , BIT-valkey-2022-35977 , EUVD-2022-38804 , GHSA-mrcw-fhw9-fj8j

cvss
5.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
14.0%
EPSS 14.0% chance of exploitation in 30 days, percentile 96%
public exploits
0
none known

Summary

Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SETRANGE` and `SORT(_RO)` commands can trigger an integer overflow, resulting with Redis attempting to allocate impossible amounts of memory and abort with an out-of-memory (OOM) panic. The problem is fixed in Redis versions 7.0.8, 6.2.9 and 6.0.17. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Patch / fix

  • bitnami keydb 6.0.17, 6.2.9, 7.0.8
  • bitnami redis 6.0.17, 6.2.9, 7.0.8
  • bitnami valkey 6.0.17, 6.2.9, 7.0.8
  • redis redis 6.0.17, 6.2.9, 7.0.8
  • redis Debian 14, Debian 13, Debian 12 5:7.0.8-1

debian advisories DEBIAN-CVE-2022-35977

  • redis Ubuntu Pro 14.04 LTS 2:2.8.4-2ubuntu0.2+esm3
  • redis Ubuntu Pro 16.04 LTS 2:3.0.6-1ubuntu0.4+esm2
  • redis Ubuntu Pro 18.04 LTS 5:4.0.9-1ubuntu0.2+esm4
  • redis Ubuntu Pro 20.04 LTS 5:5.0.7-2ubuntu0.1+esm2
  • redis Ubuntu Pro 22.04 LTS 5:6.0.16-1ubuntu1+esm1

ubuntu advisories UBUNTU-CVE-2022-35977

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • redis RHEL 8 6.2.17-1.module+el8.10.0+22680+748527fd

red hat advisories RHSA-2025:0595

  • redis SLE Module for Server Applications 15 SP4, openSUSE Leap 15.4 6.2.6-150400.3.11.1
  • redis SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES 15 SP3-LTSS +10 more 6.0.14-150200.6.17.1

suse advisories SUSE-SU-2023:0295-1SUSE-SU-2023:0274-1

  • redis openSUSE Tumbleweed 7.0.8-1.1

opensuse advisories openSUSE-SU-2024:12619-1

  • redis AlmaLinux 8 6.2.17-1.module_el8.10.0+3946+3de613d5

almalinux advisories ALSA-2025:0595

  • redis Rocky Linux 8 6.2.17-1.module+el8.10.0+1923+5b85c6a7

rocky linux advisories RLSA-2025:0595

  • redis Alpine 3.15, Alpine 3.14 6.2.9-r0
  • redis Alpine 3.24, Alpine 3.23, Alpine 3.22 +6 more 7.0.8-r0

alpine advisories ALPINE-CVE-2022-35977

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • redis CBL-Mariner 2.0 6.2.9-1

azure linux advisories AZL-13125

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2022-35977 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-35977 updated cvss 5.5

redis: Integer overflow in the Redis SETRANGE and SORT/SORT_RO commands may result with false OOM panic

  • Red Hat 3scale API Management Platform 2 3scale-amp2/backend-rhel8
    affected: no fix available
  • Red Hat Ansible Automation Platform 1.2 ansible-tower Red Hat Enterprise Linux 8 redis
    affected: no fix planned “Will not fix”
  • Red Hat OpenStack Platform 13 (Queens) redis
    affected: no fix planned “Out of support scope”
  • Red Hat Quay 3 quay/quay-rhel8 Red Hat Software Collections rh-redis6-redis
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux AppStream (v. 8) redis 6.2.17-1.module+el8.10.0+22680+748527fd
    fixed: vendor fix RHSA-2025:0595
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/search-api-rhel8 Red Hat Enterprise Linux 9 redis Red Hat Fuse 7 redis Red Hat Satellite 6 rubygem-gitlab-sidekiq-fetcher, tfm-rubygem-gitlab-sidekiq-fetcher
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
last yr.

Exploit prediction

14.05% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
OSV 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
bitnami keydb
>=6.0.0, <6.0.17
>=6.2.0, <6.2.9
>=7.0.0, <7.0.8
6.0.17
6.2.9
7.0.8
bitnami redis
>=6.0.0, <6.0.17
>=6.2.0, <6.2.9
>=7.0.0, <7.0.8
6.0.17
6.2.9
7.0.8
bitnami valkey
>=6.0.0, <6.0.17
>=6.2.0, <6.2.9
>=7.0.0, <7.0.8
6.0.17
6.2.9
7.0.8

Affected products

  • redis redis

Classification

Weakness
  • CWE-190 Integer Overflow or Wraparound
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of redis/redis published their own advisory on GitHub. Reviewed sources take precedence over it.