{"id":"CVE-2022-36021","published":"2023-03-01T15:46:23Z","modified":"2025-03-07T21:05:01Z","title":"Redis string pattern matching can be abused to achieve Denial of Service","vendor":"redis","product":"redis","tier":"core","eol":null,"affectedVersions":[{"vendor":"redis","product":"redis","versions":["< 6.0.18",">= 6.2.0, < 6.2.11",">= 7.0.0, < 7.0.9"]}],"description":{"text":"Redis is an in-memory database that persists on disk. Authenticated users can use string matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. The problem is fixed in Redis versions 6.0.18, 6.2.11, 7.0.9.\n","provenance":"source","from":"CVE.org"},"summary":{"text":"Redis, an in-memory database that persists to disk, is vulnerable to a denial-of-service flaw in its string pattern matching, where crafted patterns passed to commands such as SCAN or KEYS can make the server hang and consume 100% CPU. An attacker needs valid authenticated access to the database and the ability to issue these commands, with no user interaction required and no network-adjacent position needed beyond reaching the service.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:22:32Z"},"cvss":{"score":5.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.59769,"percentile":0.99126,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-407","name":"Inefficient Algorithmic Complexity"}],"references":[{"url":"https://github.com/redis/redis/security/advisories/GHSA-jr7j-rfj5-8xqv","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/redis/redis/commit/dcbfcb916ca1a269b3feef86ee86835294758f84","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-38807","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-38807","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-03-01","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-36021","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":23.7,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.83,"detail":"percentile 0.9913"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":3.85,"detail":"base score 5.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}