CVE-2022-35951

Redis is an in-memory database that persists on disk. Versions 7.0.0 and above, prior to 7.0.5 are vulnerable to an Integer Overflow. Executing an `XAUTOCLAIM` command on a stream key in a specific state, with a specially crafted `COUNT` argument may cause an integer overflow, a subsequent heap overflow, and potentially lead to remote code execution. This has been patched in Redis version 7.0.5. No known workarounds exist.

• CWE-190
• CWE-190

• https://github.com/redis/redis/security/advisories/GHSA-5gc4-76rx-22c9Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A7INCOOFPPEAKNDBZU3TIZJPYXBULI2C/
• https://security.gentoo.org/glsa/202209-17Third Party Advisory
• https://security.netapp.com/advisory/ntap-20221020-0005/Third Party Advisory
• https://github.com/redis/redis/security/advisories/GHSA-5gc4-76rx-22c9Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A7INCOOFPPEAKNDBZU3TIZJPYXBULI2C/
• https://security.gentoo.org/glsa/202209-17Third Party Advisory
• https://security.netapp.com/advisory/ntap-20221020-0005/Third Party Advisory

Published

Sep 23, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-35946GLPI stands for Gestionnaire Libre de Parc Informatique and …6.5
• CVE-2022-35947GLPI stands for Gestionnaire Libre de Parc Informatique and …9.8
• CVE-2022-35948undici is an HTTP/1.1 client, written from scratch for Node.…5.3
• CVE-2022-35949undici is an HTTP/1.1 client, written from scratch for Node.…9.8
• CVE-2022-3595A vulnerability was found in Linux Kernel. It has been rated…5.5
• CVE-2022-35950OroCommerce is an open-source Business to Business Commerce …4.8
• CVE-2022-35952TensorFlow is an open source platform for machine learning. …7.5
• CVE-2022-35953BookWyrm is a social network for tracking your reading, talk…6.1
• CVE-2022-35954The GitHub Actions ToolKit provides a set of packages to mak…5
• CVE-2022-35956This Rails gem adds two methods to the ActiveRecord::Base cl…9.8
• CVE-2022-35957Grafana is an open-source platform for monitoring and observ…6.6
• CVE-2022-35958Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…