CVE-2021-32626

Name of the Vulnerable Software and Affected Versions Redis versions 2.6 through 6.2.5 Redis versions 6.0.0 through 6.0.15 Redis versions 5.0.0 through 5.0.13

Description The issue is related to the Lua scripting support in Redis, where specially crafted Lua scripts can cause a heap-based Lua stack overflow due to incomplete checks. This can result in heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6.

Recommendations For versions 2.6 through 6.2.5, update to version 6.2.6 or later. For versions 6.0.0 through 6.0.15, update to version 6.0.16 or later. For versions 5.0.0 through 5.0.13, update to version 5.0.14 or later. As a temporary workaround for users unable to update, prevent users from executing Lua scripts by using ACL to restrict EVAL and EVALSHA commands.