ALPINE-CVE-2021-32625
Record from OSV · Published June 2, 2021
Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer, could be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. This is a result of an incomplete fix by CVE-2021-29477. The problem is fixed in version 6.2.4 and 6.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to use ACL configuration to prevent clients from using the STRALGO LCS command. On 64 bit systems which have the fixes of CVE-2021-29477 (6.2.3 or 6.0.13), it is sufficient to make sure that the proto-max-bulk-len config parameter is smaller than 2GB (default is 512MB).
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| redis | Alpine:v3.19 | 6.2.4-r0 |
| redis | Alpine:v3.18 | 6.2.4-r0 |
| redis | Alpine:v3.17 | 6.2.4-r0 |
| redis | Alpine:v3.13 | 6.0.14-r0 |
| redis | Alpine:v3.16 | 6.2.4-r0 |
| redis | Alpine:v3.14 | 6.2.4-r0 |
| redis | Alpine:v3.15 | 6.2.4-r0 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Alpine:v3.19 | redis | 6.0.0, 4.0.10-r1, 4.0.10-r0 |
| Alpine:v3.18 | redis | 2.8.14-r0, 6.0.0, 4.0.9-r0 |
| Alpine:v3.17 | redis | 2.4.14-r0, 6.0.0, 3.0.0-r0 |
| Alpine:v3.13 | redis | 4.0.6-r0, 0, 2.4.14-r0 |
| Alpine:v3.16 | redis | 0, 2.4.14-r0, 2.4.14-r1 |
| Alpine:v3.14 | redis | 6.0.0, 0, 2.4.14-r0 |
| Alpine:v3.15 | redis | 6.0.0, 3.0.0-r0, 3.0.0-r1 |
Timeline
- Jun 2, 2021 CVE Published
- Jul 8, 2026 CVE Updated
- Aug 8, 2026 Distribution Patch
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln ALPINE-CVE-2021-32625
vulnetix vdb fixes ALPINE-CVE-2021-32625Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/ALPINE-CVE-2021-32625/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart