CVE-2021-32672

Name: CVE-2021-32672
Creator: NVD / NIST
Published: 2021-10-04T18:15:08.78+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 4.3/10EPSS 1.70%

Last modified Jun 17, 2026

CVE-2021-32672 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. Redis is an open source, in-memory database that persists on disk. When using the Redis Lua Debugger, users can send malformed requests that cause the debugger’s protocol parser to read data beyond the actual buffer. EPSS estimates a 1.70% chance of exploitation in the next 30 days.

Description

Redis is an open source, in-memory database that persists on disk. When using the Redis Lua Debugger, users can send malformed requests that cause the debugger’s protocol parser to read data beyond the actual buffer. This issue affects all versions of Redis with Lua debugging support (3.2 or newer). The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14.

Metrics

CVSS 3.1

4.3/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS Probability

1.70%

74.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Redis	Redis	>= 3.2.0, < 5.0.14
Redis	Redis	>= 6.0.0, < 6.0.16
Redis	Redis	>= 6.2.0, < 6.2.6
Redhat	Software Collections	All versions
Redhat	Enterprise Linux	8.0
Debian	Debian Linux	10.0
Debian	Debian Linux	11.0
Fedoraproject	Fedora	33
Fedoraproject	Fedora	34
Fedoraproject	Fedora	35
Netapp	Management Services For Element Software	All versions
Netapp	Management Services For Netapp Hci	All versions
Oracle	Communications Operations Monitor	4.3
Oracle	Communications Operations Monitor	4.4
Oracle	Communications Operations Monitor	5.0

References

https://github.com/redis/redis/commit/6ac3c0b7abd35f37201ed2d6298ecef4ea1ae1ddPatch, Third Party Advisory
https://github.com/redis/redis/security/advisories/GHSA-9mj9-xx53-qmxmThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/
https://security.gentoo.org/glsa/202209-17Third Party Advisory
https://security.netapp.com/advisory/ntap-20211104-0003/Third Party Advisory
https://www.debian.org/security/2021/dsa-5001Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
https://github.com/redis/redis/commit/6ac3c0b7abd35f37201ed2d6298ecef4ea1ae1ddPatch, Third Party Advisory
https://github.com/redis/redis/security/advisories/GHSA-9mj9-xx53-qmxmThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/
https://security.gentoo.org/glsa/202209-17Third Party Advisory
https://security.netapp.com/advisory/ntap-20211104-0003/Third Party Advisory
https://www.debian.org/security/2021/dsa-5001Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory

Timeline

Published: Oct 4, 2021
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2021-32672?

How severe is CVE-2021-32672?

CVE-2021-32672 has a CVSS score of 4.3/10 (MEDIUM severity). The EPSS model estimates a 1.70% probability of exploitation in the next 30 days.

How do I fix CVE-2021-32672?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-32672?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST