CVE-2022-33105 Denial of service in n/a
A memory leak in Redis allows attackers to cause a denial of service by exhausting system memory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-33105?
CVE-2022-33105 is a high-severity denial of service vulnerability in n/a, published on 22 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Redis v7.0 was discovered to contain a memory leak via the component streamGetEdgeID.
Weakness: CWE-401
Which versions are affected by CVE-2022-33105?
3 open source packages ship an affected version, including keydb, redis and valkey. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
keydb Bitnami | From 7.0.0 | 7.0.1 |
redis Bitnami | From 7.0.0 | 7.0.1 |
valkey Bitnami | From 7.0.0 | 7.0.1 |
Products include Redis Redis.
How do I fix CVE-2022-33105?
Upgrade keydb to 7.0.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-33105 being exploited?
There is no known exploitation of CVE-2022-33105 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2022-0543 Debian-specific Redis Server Lua Sandbox Escape
- CVE-2026-23479 redis-server use-after-free in unblock client flow may allow remote code execution
- CVE-2026-25243 redis-server RESTORE invalid memory access may allow remote code execution
- CVE-2025-62507 Redis: Bug in XACKDEL may lead to stack overflow and potential RCE
- CVE-2025-48367 Redis DoS Vulnerability due to bad connection error handling
Sources
Also known as BIT-keydb-2022-33105, BIT-redis-2022-33105, BIT-valkey-2022-33105, GHSA-35rf-7vhx-9phr.