Read the docs
TI-2021-12432 Aliases CVE-2021-32765

Integer Overflow to Buffer Overflow in Hiredis

Priority MEDIUM 42CWE-190Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-190 and the CVSS impact.

Summary

Hiredis is a minimalistic C client library for the Redis database. In affected versions Hiredis is vulnurable to integer overflow if provided maliciously crafted or corrupted `RESP` `mult-bulk` protocol data. When parsing `multi-bulk` (array-like) replies, hiredis fails to check if `count * sizeof(redisReply*)` can be represented in `SIZE_MAX`. If it can not, and the `calloc()` call doesn't itself make this check, it would result in a short allocation and subsequent buffer overflow. Users of hiredis who are unable to update may set the [maxelements](https://github.com/redis/hiredis#reader-max-array-elements) context option to a value small enough that no overflow is possible.

Why it matters now

EPSS 0.02055 81st percentileScored 2026-11-07
Fix Fixed hiredis (redis): 1.0.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Redishiredisbefore 1.0.11.0.1Patch availableCNA
  • hiredis VendorRedis Affected before 1.0.1 Fixed in 1.0.1 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:redis:hiredis:*:*:*:*:*:*:*:*before 1.0.1VulnerableRedis
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:a:netapp:management_services_for_element_software_and_netapp_hci:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:redis:hiredis:*:*:*:*:*:*:*:* Versions before 1.0.1 Vulnerable ·Redis
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:a:netapp:management_services_for_element_software_and_netapp_hci:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp

Remediation

  • Fix · CNA hiredis (redis) Fixed in 1.0.1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 2 products
  • Red Hat Ansible Automation Platform 1.2
  • Red Hat Ansible Tower 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-32765

References

Patch 1

Advisory 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences