All vulnerabilities

Servers and applications

CVE-2022-31144

Redis is an in-memory database that persists on disk. A specially crafted `XAUTOCLAIM` command on a stream key in a specific state may result with heap overflow, and potentially remote code execution. This problem affects versions on the 7.x branch prior to 7.0.4. The patch is released in version 7.0.4.

Severity
High 8.8
Published
19 Jul 2022
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
7.0.4
Sources
NVD

Affected software

SoftwareAffected versions
RedisServers and applications · cpe:a:redis:redis
  • From 7.0 before 7.0.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-31144
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-31144