CVE catalog

CVE-2021-3470

redis affected and fixed versions

A heap overflow issue was found in Redis in versions before 5.0.10, before 6.0.9 and before 6.2.0 when using a heap allocator other than jemalloc or glibc's malloc, leading to potential out of bound write or process crash. Effectively this flaw does not affect the vast majority of users, who use jemalloc or glibc malloc.

Severity: Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published: Jan 1, 2021, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 1.14% · Oct 27, 2026

Projects and upstream resources

[redis][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie-security	redis	`5:8.0.2-3+deb13u3`	Fixed	[CVE-2021-3470]
Debiantrixie	redis	`5:6.0.9-1`	FixedDistribution-reported fixed boundary	[CVE-2021-3470]
Debiantrixie	redis	`5:8.0.2-3+deb13u2`	Fixed	[CVE-2021-3470]
Debiansid	redis	`5:6.0.9-1`	FixedDistribution-reported fixed boundary	[CVE-2021-3470]
Debiansid	redis	`5:8.0.6-3`	Fixed	[CVE-2021-3470]
Debianforky	redis	`5:6.0.9-1`	FixedDistribution-reported fixed boundary	[CVE-2021-3470]
Debianforky	redis	`5:8.0.6-3`	Fixed	[CVE-2021-3470]
Debianbookworm-security	redis	`5:7.0.15-1~deb12u10`	Fixed	[CVE-2021-3470]
Debianbookworm	redis	`5:6.0.9-1`	FixedDistribution-reported fixed boundary	[CVE-2021-3470]
Debianbookworm	redis	`5:7.0.15-1~deb12u7`	Fixed	[CVE-2021-3470]

Showing 10 fix observations. All 28 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Alpine3.12	redis	`5.0.11-r0`	UnknownSource applicability is not established	[ALPINE-CVE-2021-3470]Oct 23, 2026, 5:17:56 PM UTC
Alpine3.13	redis	`6.0.9-r0`	UnknownSource applicability is not established	[ALPINE-CVE-2021-3470]Oct 23, 2026, 5:17:56 PM UTC
Alpine3.14	redis	`6.2.0-r0`	UnknownSource applicability is not established	[ALPINE-CVE-2021-3470]Oct 23, 2026, 5:17:56 PM UTC
Alpine3.15	redis	`6.2.0-r0`	UnknownSource applicability is not established	[ALPINE-CVE-2021-3470]Oct 23, 2026, 5:17:56 PM UTC
Alpine3.16	redis	`6.2.0-r0`	UnknownSource applicability is not established	[ALPINE-CVE-2021-3470]Oct 23, 2026, 5:17:56 PM UTC
Alpine3.17	redis	`6.2.0-r0`	UnknownSource applicability is not established	[ALPINE-CVE-2021-3470]Oct 23, 2026, 5:17:56 PM UTC
Alpine3.18	redis	`6.2.0-r0`	UnknownSource applicability is not established	[ALPINE-CVE-2021-3470]Oct 23, 2026, 5:17:56 PM UTC
Alpine3.19	redis	`6.2.0-r0`	UnknownSource applicability is not established	[ALPINE-CVE-2021-3470]Oct 23, 2026, 5:17:56 PM UTC
Debianbookworm	redis	`5:6.0.9-1`	FixedDistribution-reported fixed boundary	[CVE-2021-3470]
Debianbookworm	redis	`5:7.0.15-1~deb12u7`	Fixed	[CVE-2021-3470]
Debianbookworm-security	redis	`5:7.0.15-1~deb12u10`	Fixed	[CVE-2021-3470]
Debianforky	redis	`5:6.0.9-1`	FixedDistribution-reported fixed boundary	[CVE-2021-3470]
Debianforky	redis	`5:8.0.6-3`	Fixed	[CVE-2021-3470]
Debiansid	redis	`5:6.0.9-1`	FixedDistribution-reported fixed boundary	[CVE-2021-3470]
Debiansid	redis	`5:8.0.6-3`	Fixed	[CVE-2021-3470]
Debiantrixie	redis	`5:6.0.9-1`	FixedDistribution-reported fixed boundary	[CVE-2021-3470]
Debiantrixie	redis	`5:8.0.2-3+deb13u2`	Fixed	[CVE-2021-3470]
Debiantrixie-security	redis	`5:8.0.2-3+deb13u3`	Fixed	[CVE-2021-3470]
Ubuntupro	redis	`5:5.0.5-2build1`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-3470]Apr 14, 2026, 9:49:33 AM UTC
Ubuntupro	redis	`5:5.0.6-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-3470]Apr 14, 2026, 9:49:33 AM UTC
Ubuntupro	redis	`5:5.0.7-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-3470]Apr 14, 2026, 9:49:33 AM UTC
Ubuntupro	redis	`5:5.0.7-2`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-3470]Apr 14, 2026, 9:49:33 AM UTC
Ubuntupro	redis	`5:5.0.7-2ubuntu0.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-3470]Apr 14, 2026, 9:49:33 AM UTC
Ubuntupro	redis	`5:5.0.7-2ubuntu0.1+esm1`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-3470]Apr 14, 2026, 9:49:33 AM UTC
Ubuntupro	redis	`5:5.0.7-2ubuntu0.1+esm2`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-3470]Apr 14, 2026, 9:49:33 AM UTC
Ubuntupro	redis	`5:5.0.7-2ubuntu0.1+esm3`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-3470]Apr 14, 2026, 9:49:33 AM UTC
Ubuntupro	redis	`5:5.0.7-2ubuntu0.1+esm4`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-3470]Apr 14, 2026, 9:49:33 AM UTC
Ubuntupro	redis	`5:5.0.7-2ubuntu0.1~esm1`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-3470]Apr 14, 2026, 9:49:33 AM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "redis",
      "status": "fixed",
      "release": "sid",
      "version": "5:8.0.6-3"
    },
    {
      "name": "redis",
      "status": "fixed",
      "release": "forky",
      "version": "5:8.0.6-3"
    },
    {
      "name": "redis",
      "status": "fixed",
      "release": "trixie",
      "version": "5:8.0.2-3+deb13u2"
    },
    {
      "name": "redis",
      "status": "fixed",
      "release": "trixie-security",
      "version": "5:8.0.2-3+deb13u3"
    },
    {
      "name": "redis",
      "status": "fixed",
      "release": "bookworm",
      "version": "5:7.0.15-1~deb12u7"
    },
    {
      "name": "redis",
      "status": "fixed",
      "release": "bookworm-security",
      "version": "5:7.0.15-1~deb12u10"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "redis",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "unimportant",
      "fixed_version": "5:6.0.9-1"
    },
    {
      "bug": null,
      "name": "redis",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "unimportant",
      "fixed_version": "5:6.0.9-1"
    },
    {
      "bug": null,
      "name": "redis",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "unimportant",
      "fixed_version": "5:6.0.9-1"
    },
    {
      "bug": null,
      "name": "redis",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "unimportant",
      "fixed_version": "5:6.0.9-1"
    }
  ],
  "distribution_packages": [
    {
      "name": "redis",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "5.0.11-r0"
            }
          ]
        }
      ],
      "release": "3.12",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2021-3470",
      "fixed_version": "5.0.11-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2021-3470",
      "provider_updated_at": "2026-10-23T17:17:56.194395056Z",
      "applicability_unknown": true
    },
    {
      "name": "redis",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "6.0.9-r0"
            }
          ]
        }
      ],
      "release": "3.13",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2021-3470",
      "fixed_version": "6.0.9-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2021-3470",
      "provider_updated_at": "2026-10-23T17:17:56.194395056Z",
      "applicability_unknown": true
    },
    {
      "name": "redis",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "6.2.0-r0"
            }
          ]
        }
      ],
      "release": "3.14",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2021-3470",
      "fixed_version": "6.2.0-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2021-3470",
      "provider_updated_at": "2026-10-23T17:17:56.194395056Z",
      "applicability_unknown": true
    },
    {
      "name": "redis",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "6.2.0-r0"
            }
          ]
        }
      ],
      "release": "3.15",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2021-3470",
      "fixed_version": "6.2.0-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2021-3470",
      "provider_updated_at": "2026-10-23T17:17:56.194395056Z",
      "applicability_unknown": true
    },
    {
      "name": "redis",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "6.2.0-r0"
            }
          ]
        }
      ],
      "release": "3.16",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2021-3470",
      "fixed_version": "6.2.0-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2021-3470",
      "provider_updated_at": "2026-10-23T17:17:56.194395056Z",
      "applicability_unknown": true
    },
    {
      "name": "redis",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "6.2.0-r0"
            }
          ]
        }
      ],
      "release": "3.17",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2021-3470",
      "fixed_version": "6.2.0-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2021-3470",
      "provider_updated_at": "2026-10-23T17:17:56.194395056Z",
      "applicability_unknown": true
    },
    {
      "name": "redis",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "6.2.0-r0"
            }
          ]
        }
      ],
      "release": "3.18",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2021-3470",
      "fixed_version": "6.2.0-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2021-3470",
      "provider_updated_at": "2026-10-23T17:17:56.194395056Z",
      "applicability_unknown": true
    },
    {
      "name": "redis",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "6.2.0-r0"
            }
          ]
        }
      ],
      "release": "3.19",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2021-3470",
      "fixed_version": "6.2.0-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2021-3470",
      "provider_updated_at": "2026-10-23T17:17:56.194395056Z",
      "applicability_unknown": true
    },
    {
      "name": "redis",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "5:5.0.5-2build1",
        "5:5.0.6-1",
        "5:5.0.7-1",
        "5:5.0.7-2",
        "5:5.0.7-2ubuntu0.1~esm1",
        "5:5.0.7-2ubuntu0.1",
        "5:5.0.7-2ubuntu0.1+esm1",
        "5:5.0.7-2ubuntu0.1+esm2",
        "5:5.0.7-2ubuntu0.1+esm3",
        "5:5.0.7-2ubuntu0.1+esm4"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2021-3470",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2021-3470",
      "provider_updated_at": "2026-04-14T09:49:33.405671Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[redis]Unknown
Details (4)
- 5:7.0.15-1~deb12u7 · all · bookworm
  Fixed · Fixed: 5:6.0.9-1
  dsa · redis · debian · bookworm; dsa · redis · debian · 12
- 5:7.0.15-1~deb12u7 · all · bookworm
  Fixed · Fixed: 5:6.0.9-1
  dsa · redis · debian · bookworm; dsa · redis · debian · 12
- 5:7.0.15-1~deb12u9 · all · bookworm-security
  Fixed · Fixed: 5:6.0.9-1
  dsa · redis · debian · bookworm; dsa · redis · debian · 12
- 5:7.0.15-1~deb12u9 · all · bookworm-security
  Fixed · Fixed: 5:6.0.9-1
  dsa · redis · debian · bookworm; dsa · redis · debian · 12
[redis-sentinel]Unknown
Source package: [redis]
Details (4)
- 5:7.0.15-1~deb12u7 · amd64 · bookworm
  Fixed · Fixed: 5:6.0.9-1
  dsa · redis · debian · bookworm; dsa · redis · debian · 12
- 5:7.0.15-1~deb12u7 · arm64 · bookworm
  Fixed · Fixed: 5:6.0.9-1
  dsa · redis · debian · bookworm; dsa · redis · debian · 12
- 5:7.0.15-1~deb12u9 · amd64 · bookworm-security
  Fixed · Fixed: 5:6.0.9-1
  dsa · redis · debian · bookworm; dsa · redis · debian · 12
- 5:7.0.15-1~deb12u9 · arm64 · bookworm-security
  Fixed · Fixed: 5:6.0.9-1
  dsa · redis · debian · bookworm; dsa · redis · debian · 12
[redis-server]Unknown
Source package: [redis]
Details (4)
- 5:7.0.15-1~deb12u7 · amd64 · bookworm
  Fixed · Fixed: 5:6.0.9-1
  dsa · redis · debian · bookworm; dsa · redis · debian · 12
- 5:7.0.15-1~deb12u7 · arm64 · bookworm
  Fixed · Fixed: 5:6.0.9-1
  dsa · redis · debian · bookworm; dsa · redis · debian · 12
- 5:7.0.15-1~deb12u9 · amd64 · bookworm-security
  Fixed · Fixed: 5:6.0.9-1
  dsa · redis · debian · bookworm; dsa · redis · debian · 12
- 5:7.0.15-1~deb12u9 · arm64 · bookworm-security
  Fixed · Fixed: 5:6.0.9-1
  dsa · redis · debian · bookworm; dsa · redis · debian · 12
[redis-tools]Unknown
Source package: [redis]
Details (4)
- 5:7.0.15-1~deb12u7 · amd64 · bookworm
  Fixed · Fixed: 5:6.0.9-1
  dsa · redis · debian · bookworm; dsa · redis · debian · 12
- 5:7.0.15-1~deb12u7 · arm64 · bookworm
  Fixed · Fixed: 5:6.0.9-1
  dsa · redis · debian · bookworm; dsa · redis · debian · 12
- 5:7.0.15-1~deb12u9 · amd64 · bookworm-security
  Fixed · Fixed: 5:6.0.9-1
  dsa · redis · debian · bookworm; dsa · redis · debian · 12
- 5:7.0.15-1~deb12u9 · arm64 · bookworm-security
  Fixed · Fixed: 5:6.0.9-1
  dsa · redis · debian · bookworm; dsa · redis · debian · 12

[Debian 13 (Trixie)]

[redis]Unknown
Details (5)
- 5:8.0.2-3+deb13u2 · all · trixie
  Fixed · Fixed: 5:6.0.9-1
  dsa · redis · debian · 13
- 5:8.0.2-3+deb13u2 · all · trixie
  Fixed · Fixed: 5:6.0.9-1
  dsa · redis · debian · 13
- 5:8.0.2-3+deb13u2 · all · trixie-security
  Fixed · Fixed: 5:6.0.9-1
  dsa · redis · debian · 13
- 5:8.0.2-3+deb13u2 · all · trixie-security · Historical version
  Fixed · Fixed: 5:6.0.9-1
  dsa · redis · debian · 13
- 5:8.0.2-3+deb13u3 · all · trixie-security
  Fixed · Fixed: 5:6.0.9-1
  dsa · redis · debian · 13
[redis-sentinel]Unknown
Source package: [redis]
Details (5)
- 5:8.0.2-3+deb13u2 · amd64 · trixie
  Fixed · Fixed: 5:6.0.9-1
  dsa · redis · debian · 13
- 5:8.0.2-3+deb13u2 · arm64 · trixie
  Fixed · Fixed: 5:6.0.9-1
  dsa · redis · debian · 13
- 5:8.0.2-3+deb13u2 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 5:6.0.9-1
  dsa · redis · debian · 13
- 5:8.0.2-3+deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 5:6.0.9-1
  dsa · redis · debian · 13
- 5:8.0.2-3+deb13u3 · amd64 · trixie-security
  Fixed · Fixed: 5:6.0.9-1
  dsa · redis · debian · 13
[redis-server]Unknown
Source package: [redis]
Details (5)
- 5:8.0.2-3+deb13u2 · amd64 · trixie
  Fixed · Fixed: 5:6.0.9-1
  dsa · redis · debian · 13
- 5:8.0.2-3+deb13u2 · arm64 · trixie
  Fixed · Fixed: 5:6.0.9-1
  dsa · redis · debian · 13
- 5:8.0.2-3+deb13u2 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 5:6.0.9-1
  dsa · redis · debian · 13
- 5:8.0.2-3+deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 5:6.0.9-1
  dsa · redis · debian · 13
- 5:8.0.2-3+deb13u3 · amd64 · trixie-security
  Fixed · Fixed: 5:6.0.9-1
  dsa · redis · debian · 13
[redis-tools]Unknown
Source package: [redis]
Details (5)
- 5:8.0.2-3+deb13u2 · amd64 · trixie
  Fixed · Fixed: 5:6.0.9-1
  dsa · redis · debian · 13
- 5:8.0.2-3+deb13u2 · arm64 · trixie
  Fixed · Fixed: 5:6.0.9-1
  dsa · redis · debian · 13
- 5:8.0.2-3+deb13u2 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 5:6.0.9-1
  dsa · redis · debian · 13
- 5:8.0.2-3+deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 5:6.0.9-1
  dsa · redis · debian · 13
- 5:8.0.2-3+deb13u3 · amd64 · trixie-security
  Fixed · Fixed: 5:6.0.9-1
  dsa · redis · debian · 13

Observed: Oct 23, 2026, 5:58:13 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]