CVE-2022-31144

A heap-based buffer overflow flaw was found in Redis within the XAUTOCLAIM command implementation. This flaw allows an attacker to craft the XAUTOCLAIM command with malicious data on a stream key in a specific state that triggers a heap-based buffer overflow, possibly enabling remote code execution.

The vulnerable code was introduced in Redis v7.0.0 and affects only Redis v7.0.0 and higher versions. Hence, Red Hat Enterprise Linux - 8, 9 with Redis v6.x.x are NOT-AFFECTED.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.