CVE-2022-35951

Name of the Vulnerable Software and Affected Versions Redis versions 7.0.0 through 7.0.4

Description The issue is related to an integer overflow when handling the COUNT argument in the XAUTOCLAIM command on a stream key in a specific state. This may cause a subsequent heap overflow and potentially lead to remote code execution. The problem affects the 7.x branch and requires access to execute queries to carry out an attack.

Recommendations For Redis versions 7.0.0 through 7.0.4, update to Redis version 7.0.5 to resolve the issue. As a temporary workaround, consider restricting access to the XAUTOCLAIM command to minimize the risk of exploitation. Avoid using a specially crafted COUNT argument in the affected command until the issue is resolved.