CVE catalog

CVE-2022-36021

redis affected and fixed versions

[CVE catalog]

Redis is an in-memory database that persists on disk. Authenticated users can use string matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. The problem is fixed in Redis versions 6.0.18, 6.2.11, 7.0.9.

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
59.77% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiantrixie-securityredis5:8.0.2-3+deb13u3Fixed[CVE-2022-36021]
Debiantrixieredis5:7.0.9-1FixedDistribution-reported fixed boundary[CVE-2022-36021]
Debiantrixieredis5:8.0.2-3+deb13u2Fixed[CVE-2022-36021]
Debiansidredis5:7.0.9-1FixedDistribution-reported fixed boundary[CVE-2022-36021]
Debiansidredis5:8.0.6-3Fixed[CVE-2022-36021]
Debianforkyredis5:7.0.9-1FixedDistribution-reported fixed boundary[CVE-2022-36021]
Debianforkyredis5:8.0.6-3Fixed[CVE-2022-36021]
Debianbookworm-securityredis5:7.0.15-1~deb12u10Fixed[CVE-2022-36021]
Debianbookwormredis5:7.0.15-1~deb12u7Fixed[CVE-2022-36021]
Debianbookwormredis5:7.0.9-1FixedDistribution-reported fixed boundary[CVE-2022-36021]

Showing 10 fix observations. All 32 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
Debianbookwormredis5:7.0.15-1~deb12u7Fixed[CVE-2022-36021]
Debianbookwormredis5:7.0.9-1FixedDistribution-reported fixed boundary[CVE-2022-36021]
Debianbookworm-securityredis5:7.0.15-1~deb12u10Fixed[CVE-2022-36021]
Debianforkyredis5:7.0.9-1FixedDistribution-reported fixed boundary[CVE-2022-36021]
Debianforkyredis5:8.0.6-3Fixed[CVE-2022-36021]
Debiansidredis5:7.0.9-1FixedDistribution-reported fixed boundary[CVE-2022-36021]
Debiansidredis5:8.0.6-3Fixed[CVE-2022-36021]
Debiantrixieredis5:7.0.9-1FixedDistribution-reported fixed boundary[CVE-2022-36021]
Debiantrixieredis5:8.0.2-3+deb13u2Fixed[CVE-2022-36021]
Debiantrixie-securityredis5:8.0.2-3+deb13u3Fixed[CVE-2022-36021]
Opensuseleap 15.4redis6.2.6-150400.3.16.1UnknownSource applicability is not established[SUSE-SU-2023:0694-1]
Opensuseleap 15.4redis6.2.6-150400.3.19.1UnknownSource applicability is not established[SUSE-SU-2023:2122-1]
Opensusetumbleweedredis7.0.8-2.1UnknownSource applicability is not established[OPENSUSE-SU-2024:12743-1]
Suseenterprise storage 7redis6.0.14-150200.6.20.1UnknownSource applicability is not established[SUSE-SU-2023:0693-1]
Suseenterprise storage 7.1redis6.0.14-150200.6.20.1UnknownSource applicability is not established[SUSE-SU-2023:0693-1]
Suselinux enterprise high performance computing 15 sp2-ltssredis6.0.14-150200.6.20.1UnknownSource applicability is not established[SUSE-SU-2023:0693-1]
Suselinux enterprise high performance computing 15 sp3-esposredis6.0.14-150200.6.20.1UnknownSource applicability is not established[SUSE-SU-2023:0693-1]
Suselinux enterprise high performance computing 15 sp3-ltssredis6.0.14-150200.6.20.1UnknownSource applicability is not established[SUSE-SU-2023:0693-1]
Suselinux enterprise module for server applications 15 sp4redis6.2.6-150400.3.16.1UnknownSource applicability is not established[SUSE-SU-2023:0694-1]
Suselinux enterprise module for server applications 15 sp4redis6.2.6-150400.3.19.1UnknownSource applicability is not established[SUSE-SU-2023:2122-1]
Suselinux enterprise real time 15 sp3redis6.0.14-150200.6.20.1UnknownSource applicability is not established[SUSE-SU-2023:0693-1]
Suselinux enterprise server 15 sp2-ltssredis6.0.14-150200.6.20.1UnknownSource applicability is not established[SUSE-SU-2023:0693-1]
Suselinux enterprise server 15 sp3-ltssredis6.0.14-150200.6.20.1UnknownSource applicability is not established[SUSE-SU-2023:0693-1]
Suselinux enterprise server for sap applications 15 sp2redis6.0.14-150200.6.20.1UnknownSource applicability is not established[SUSE-SU-2023:0693-1]
Suselinux enterprise server for sap applications 15 sp3redis6.0.14-150200.6.20.1UnknownSource applicability is not established[SUSE-SU-2023:0693-1]
Susemanager proxy 4.2redis6.0.14-150200.6.20.1UnknownSource applicability is not established[SUSE-SU-2023:0693-1]
Susemanager server 4.2redis6.0.14-150200.6.20.1UnknownSource applicability is not established[SUSE-SU-2023:0693-1]
Ubuntuproredis5:6.0.15-1UnknownSource applicability is not established[UBUNTU-CVE-2022-36021]
Ubuntuproredis5:6.0.16-1UnknownSource applicability is not established[UBUNTU-CVE-2022-36021]
Ubuntuproredis5:6.0.16-1build1UnknownSource applicability is not established[UBUNTU-CVE-2022-36021]
Ubuntuproredis5:6.0.16-1ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2022-36021]
Ubuntuproredis5:6.0.16-1ubuntu1+esm1UnknownSource applicability is not established[UBUNTU-CVE-2022-36021]
Original provider fields
{
  "package_releases": [
    {
      "name": "redis",
      "status": "fixed",
      "release": "sid",
      "version": "5:8.0.6-3"
    },
    {
      "name": "redis",
      "status": "fixed",
      "release": "forky",
      "version": "5:8.0.6-3"
    },
    {
      "name": "redis",
      "status": "fixed",
      "release": "trixie",
      "version": "5:8.0.2-3+deb13u2"
    },
    {
      "name": "redis",
      "status": "fixed",
      "release": "trixie-security",
      "version": "5:8.0.2-3+deb13u3"
    },
    {
      "name": "redis",
      "status": "fixed",
      "release": "bookworm",
      "version": "5:7.0.15-1~deb12u7"
    },
    {
      "name": "redis",
      "status": "fixed",
      "release": "bookworm-security",
      "version": "5:7.0.15-1~deb12u10"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "redis",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "5:7.0.9-1"
    },
    {
      "bug": null,
      "name": "redis",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "5:7.0.9-1"
    },
    {
      "bug": null,
      "name": "redis",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "5:7.0.9-1"
    },
    {
      "bug": null,
      "name": "redis",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "5:7.0.9-1"
    }
  ],
  "distribution_packages": [
    {
      "name": "redis",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.2.6-150400.3.16.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for server applications 15 sp4",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:0694-1",
      "fixed_version": "6.2.6-150400.3.16.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:0694-1",
      "provider_updated_at": "2026-02-04T03:17:09.581960Z",
      "applicability_unknown": true
    },
    {
      "name": "redis",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.2.6-150400.3.16.1"
            }
          ]
        }
      ],
      "release": "leap 15.4",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:0694-1",
      "fixed_version": "6.2.6-150400.3.16.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:0694-1",
      "provider_updated_at": "2026-02-04T03:17:09.581960Z",
      "applicability_unknown": true
    },
    {
      "name": "redis",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.2.6-150400.3.19.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for server applications 15 sp4",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:2122-1",
      "fixed_version": "6.2.6-150400.3.19.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:2122-1",
      "provider_updated_at": "2026-02-04T03:11:08.554993Z",
      "applicability_unknown": true
    },
    {
      "name": "redis",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.2.6-150400.3.19.1"
            }
          ]
        }
      ],
      "release": "leap 15.4",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:2122-1",
      "fixed_version": "6.2.6-150400.3.19.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:2122-1",
      "provider_updated_at": "2026-02-04T03:11:08.554993Z",
      "applicability_unknown": true
    },
    {
      "name": "redis",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5:6.0.16-1ubuntu1+esm1"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "5:6.0.15-1",
        "5:6.0.16-1",
        "5:6.0.16-1build1",
        "5:6.0.16-1ubuntu1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-36021",
      "fixed_version": "5:6.0.16-1ubuntu1+esm1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-36021",
      "provider_updated_at": "2026-02-04T02:44:33.963473Z",
      "applicability_unknown": true
    },
    {
      "name": "redis",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.14-150200.6.20.1"
            }
          ]
        }
      ],
      "release": "linux enterprise high performance computing 15 sp2-ltss",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:0693-1",
      "fixed_version": "6.0.14-150200.6.20.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:0693-1",
      "provider_updated_at": "2026-02-04T02:24:25.597402Z",
      "applicability_unknown": true
    },
    {
      "name": "redis",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.14-150200.6.20.1"
            }
          ]
        }
      ],
      "release": "linux enterprise high performance computing 15 sp3-espos",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:0693-1",
      "fixed_version": "6.0.14-150200.6.20.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:0693-1",
      "provider_updated_at": "2026-02-04T02:24:25.597402Z",
      "applicability_unknown": true
    },
    {
      "name": "redis",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.14-150200.6.20.1"
            }
          ]
        }
      ],
      "release": "linux enterprise high performance computing 15 sp3-ltss",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:0693-1",
      "fixed_version": "6.0.14-150200.6.20.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:0693-1",
      "provider_updated_at": "2026-02-04T02:24:25.597402Z",
      "applicability_unknown": true
    },
    {
      "name": "redis",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.14-150200.6.20.1"
            }
          ]
        }
      ],
      "release": "linux enterprise real time 15 sp3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:0693-1",
      "fixed_version": "6.0.14-150200.6.20.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:0693-1",
      "provider_updated_at": "2026-02-04T02:24:25.597402Z",
      "applicability_unknown": true
    },
    {
      "name": "redis",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.14-150200.6.20.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server 15 sp2-ltss",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:0693-1",
      "fixed_version": "6.0.14-150200.6.20.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:0693-1",
      "provider_updated_at": "2026-02-04T02:24:25.597402Z",
      "applicability_unknown": true
    },
    {
      "name": "redis",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.14-150200.6.20.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server 15 sp3-ltss",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:0693-1",
      "fixed_version": "6.0.14-150200.6.20.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:0693-1",
      "provider_updated_at": "2026-02-04T02:24:25.597402Z",
      "applicability_unknown": true
    },
    {
      "name": "redis",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.14-150200.6.20.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server for sap applications 15 sp2",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:0693-1",
      "fixed_version": "6.0.14-150200.6.20.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:0693-1",
      "provider_updated_at": "2026-02-04T02:24:25.597402Z",
      "applicability_unknown": true
    },
    {
      "name": "redis",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.14-150200.6.20.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server for sap applications 15 sp3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:0693-1",
      "fixed_version": "6.0.14-150200.6.20.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:0693-1",
      "provider_updated_at": "2026-02-04T02:24:25.597402Z",
      "applicability_unknown": true
    },
    {
      "name": "redis",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.14-150200.6.20.1"
            }
          ]
        }
      ],
      "release": "manager proxy 4.2",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:0693-1",
      "fixed_version": "6.0.14-150200.6.20.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:0693-1",
      "provider_updated_at": "2026-02-04T02:24:25.597402Z",
      "applicability_unknown": true
    },
    {
      "name": "redis",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.14-150200.6.20.1"
            }
          ]
        }
      ],
      "release": "manager server 4.2",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:0693-1",
      "fixed_version": "6.0.14-150200.6.20.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:0693-1",
      "provider_updated_at": "2026-02-04T02:24:25.597402Z",
      "applicability_unknown": true
    },
    {
      "name": "redis",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.14-150200.6.20.1"
            }
          ]
        }
      ],
      "release": "enterprise storage 7",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:0693-1",
      "fixed_version": "6.0.14-150200.6.20.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:0693-1",
      "provider_updated_at": "2026-02-04T02:24:25.597402Z",
      "applicability_unknown": true
    },
    {
      "name": "redis",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.14-150200.6.20.1"
            }
          ]
        }
      ],
      "release": "enterprise storage 7.1",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:0693-1",
      "fixed_version": "6.0.14-150200.6.20.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:0693-1",
      "provider_updated_at": "2026-02-04T02:24:25.597402Z",
      "applicability_unknown": true
    },
    {
      "name": "redis",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.8-2.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2024:12743-1",
      "fixed_version": "7.0.8-2.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2024:12743-1",
      "provider_updated_at": "2025-05-07T18:14:13.468222Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [redis]Unknown
    Details (4)
    • 5:7.0.15-1~deb12u7 · all · bookworm

      Fixed · Fixed: 5:7.0.9-1

      dsa · redis · debian · bookworm

    • 5:7.0.15-1~deb12u7 · all · bookworm

      Fixed · Fixed: 5:7.0.9-1

      dsa · redis · debian · bookworm

    • 5:7.0.15-1~deb12u9 · all · bookworm-security

      Fixed · Fixed: 5:7.0.9-1

      dsa · redis · debian · bookworm

    • 5:7.0.15-1~deb12u9 · all · bookworm-security

      Fixed · Fixed: 5:7.0.9-1

      dsa · redis · debian · bookworm

  • Source package: [redis]

    Details (4)
    • 5:7.0.15-1~deb12u7 · amd64 · bookworm

      Fixed · Fixed: 5:7.0.9-1

      dsa · redis · debian · bookworm

    • 5:7.0.15-1~deb12u7 · arm64 · bookworm

      Fixed · Fixed: 5:7.0.9-1

      dsa · redis · debian · bookworm

    • 5:7.0.15-1~deb12u9 · amd64 · bookworm-security

      Fixed · Fixed: 5:7.0.9-1

      dsa · redis · debian · bookworm

    • 5:7.0.15-1~deb12u9 · arm64 · bookworm-security

      Fixed · Fixed: 5:7.0.9-1

      dsa · redis · debian · bookworm

  • [redis-server]Unknown

    Source package: [redis]

    Details (4)
    • 5:7.0.15-1~deb12u7 · amd64 · bookworm

      Fixed · Fixed: 5:7.0.9-1

      dsa · redis · debian · bookworm

    • 5:7.0.15-1~deb12u7 · arm64 · bookworm

      Fixed · Fixed: 5:7.0.9-1

      dsa · redis · debian · bookworm

    • 5:7.0.15-1~deb12u9 · amd64 · bookworm-security

      Fixed · Fixed: 5:7.0.9-1

      dsa · redis · debian · bookworm

    • 5:7.0.15-1~deb12u9 · arm64 · bookworm-security

      Fixed · Fixed: 5:7.0.9-1

      dsa · redis · debian · bookworm

  • [redis-tools]Unknown

    Source package: [redis]

    Details (4)
    • 5:7.0.15-1~deb12u7 · amd64 · bookworm

      Fixed · Fixed: 5:7.0.9-1

      dsa · redis · debian · bookworm

    • 5:7.0.15-1~deb12u7 · arm64 · bookworm

      Fixed · Fixed: 5:7.0.9-1

      dsa · redis · debian · bookworm

    • 5:7.0.15-1~deb12u9 · amd64 · bookworm-security

      Fixed · Fixed: 5:7.0.9-1

      dsa · redis · debian · bookworm

    • 5:7.0.15-1~deb12u9 · arm64 · bookworm-security

      Fixed · Fixed: 5:7.0.9-1

      dsa · redis · debian · bookworm

[openSUSE Tumbleweed]

  • [redis]Unknown

    Source package: [redis]

    Details (1)
    • 8.10.1-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 7.0.8-2.1

      dsa · redis · opensuse · tumbleweed

Observed:

References