CVE-2022-36021 Redis string pattern matching can be abused to achieve Denial of Service

What is CVE-2022-36021?

CVE-2022-36021 is a medium-severity denial of service vulnerability in redis, published on 1 Mar 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Redis is an in-memory database that persists on disk. Authenticated users can use string matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. The problem is fixed in Redis versions 6.0.18, 6.2.11, 7.0.9.

Weakness: CWE-407

Which versions are affected by CVE-2022-36021?

3 open source packages ship an affected version, including redis, keydb and valkey. It affects 1 product.

Products include Redis Redis.

How do I fix CVE-2022-36021?

Upgrade redis to a fixed version for your release line: 6.0.18, 6.2.11 or 7.0.9.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-36021 being exploited?

There is no known exploitation of CVE-2022-36021 in the wild and no public exploit code.

Other vulnerabilities in redis

• CVE-2022-0543 Debian-specific Redis Server Lua Sandbox Escape Exploited Critical 10.0
• CVE-2026-23479 redis-server use-after-free in unblock client flow may allow remote code execution High 7.7
• CVE-2026-25243 redis-server RESTORE invalid memory access may allow remote code execution High 7.7
• CVE-2025-62507 Redis: Bug in XACKDEL may lead to stack overflow and potential RCE High 7.7
• CVE-2025-48367 Redis DoS Vulnerability due to bad connection error handling High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-13830, BIT-keydb-2022-36021, BIT-redis-2022-36021, BIT-valkey-2022-36021, DEBIAN-CVE-2022-36021, DLA-3361-1 and 3 more.