CVE-2021-32672 Vulnerability in Lua Debugger in Redis

What is CVE-2021-32672?

CVE-2021-32672 is a medium-severity vulnerability in Debian Debian Linux, published on 4 Oct 2021.

Official description

Redis is an open source, in-memory database that persists on disk. When using the Redis Lua Debugger, users can send malformed requests that cause the debugger’s protocol parser to read data beyond the actual buffer. This issue affects all versions of Redis with Lua debugging support (3.2 or newer). The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14.

Weakness: CWE-125

Which versions are affected by CVE-2021-32672?

3 open source packages ship an affected version, including keydb, redis and valkey. It affects 8 products.

Products include Debian Debian Linux, Fedoraproject Fedora, Netapp Management Services for Element Software, Netapp Management Services for Netapp Hci, Oracle Communications Operations Monitor, Redhat Enterprise Linux and 2 more.

How do I fix CVE-2021-32672?

Upgrade keydb to a fixed version for your release line: 5.0.14, 6.0.16 or 6.2.6.

Is CVE-2021-32672 being exploited?

There is no known exploitation of CVE-2021-32672 in the wild and no public exploit code.

Other vulnerabilities in Debian Debian Linux

• CVE-2015-3306 ProFTPD Improper Access Control Exploited Critical 10.0
• CVE-2025-49113 RoundCube Webmail Deserialization of Untrusted Data Exploited Critical 9.9
• CVE-2026-24061 GNU InetUtils Argument Injection Exploited Critical 9.8
• CVE-2025-39682 Linux Kernel Improper Check for Unusual or Exceptional Conditions Exploited Critical 9.8
• CVE-2024-9680 Mozilla Firefox Use-After-Free Exploited Critical 9.8

All Debian Debian Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2021-32672, AZL-6847, BIT-keydb-2021-32672, BIT-redis-2021-32672, BIT-valkey-2021-32672, CLEANSTART-2026-AE22523 and 5 more.