CVE-2021-31294 Denial of service in n/a

What is CVE-2021-31294?

CVE-2021-31294 is a medium-severity denial of service vulnerability in n/a, published on 15 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by sending a non-administrative command (specifically, a SET command). NOTE: this was fixed for Redis 6.2.x and 7.x in 2021. Versions before 6.2 were not intended to have safety guarantees related to this.

Weakness: CWE-617

Which versions are affected by CVE-2021-31294?

3 open source packages ship an affected version, including keydb, redis and valkey. It affects 1 product.

Products include Redis Redis.

How do I fix CVE-2021-31294?

Upgrade keydb to 6.2.0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-31294 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-31294 exists.

Other vulnerabilities in n/a

• CVE-2022-0543 Debian-specific Redis Server Lua Sandbox Escape Exploited Critical 10.0
• CVE-2026-23479 redis-server use-after-free in unblock client flow may allow remote code execution High 7.7
• CVE-2026-25243 redis-server RESTORE invalid memory access may allow remote code execution High 7.7
• CVE-2025-62507 Redis: Bug in XACKDEL may lead to stack overflow and potential RCE High 7.7
• CVE-2025-48367 Redis DoS Vulnerability due to bad connection error handling High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-keydb-2021-31294, BIT-redis-2021-31294, BIT-valkey-2021-31294, DEBIAN-CVE-2021-31294, GHSA-g2jg-2qcv-q3h9, UBUNTU-CVE-2021-31294.