CVE-2021-32785 Format string bug in the Redis cache implementation

What is CVE-2021-32785?

CVE-2021-32785 is a medium-severity vulnerability in Debian Debian Linux, published on 22 Jul 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. When mod_auth_openidc versions prior to 2.4.9 are configured to use an unencrypted Redis cache (`OIDCCacheEncrypt off`, `OIDCSessionType server-cache`, `OIDCCacheType redis`), `mod_auth_openidc` wrongly performed argument interpolation before passing Redis requests to `hiredis`, which would perform it again and lead to an uncontrolled format string bug. Initial assessment shows that this bug does not appear to allow gaining arbitrary code execution, but can reliably provoke a denial of service by repeatedly crashing the Apache workers. This bug has been corrected in version 2.4.9 by performing argument interpolation only once, using the `hiredis` API. As a workaround, this vulnerability can be mitigated by setting `OIDCCacheEncrypt` to `on`, as cache keys are cryptographically hashed before use when this option is enabled.

Weakness: CWE-134

Which versions are affected by CVE-2021-32785?

It affects 3 products.

Products include Debian Debian Linux, Netapp Cloud Backup, Openidc Mod Auth Openidc.

How do I fix CVE-2021-32785?

Upgrade to a fixed version.

Is CVE-2021-32785 being exploited?

There is no known exploitation of CVE-2021-32785 in the wild and no public exploit code.

Other vulnerabilities in Debian Debian Linux

• CVE-2015-3306 ProFTPD Improper Access Control Exploited Critical 10.0
• CVE-2025-49113 RoundCube Webmail Deserialization of Untrusted Data Exploited Critical 9.9
• CVE-2026-24061 GNU InetUtils Argument Injection Exploited Critical 9.8
• CVE-2025-39682 Linux Kernel Improper Check for Unusual or Exceptional Conditions Exploited Critical 9.8
• CVE-2024-9680 Mozilla Firefox Use-After-Free Exploited Critical 9.8

All Debian Debian Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-6479, DEBIAN-CVE-2021-32785, GHSA-55r8-6w97-xxr4, UBUNTU-CVE-2021-32785.