CVE-2021-32765

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-32765
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32765.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-32765
Aliases
  • GHSA-hfm9-39pp-55p2
Downstream
DEBIAN (1)
MGASA (1)
OESA (1)
openSUSE (3)
UBUNTU (1)
Related
openSUSE (3)
Published
2021-10-04T21:15:12Z
Modified
2026-07-09T11:34:46Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Hiredis is a minimalistic C client library for the Redis database. In affected versions Hiredis is vulnurable to integer overflow if provided maliciously crafted or corrupted RESP mult-bulk protocol data. When parsing multi-bulk (array-like) replies, hiredis fails to check if count * sizeof(redisReply*) can be represented in SIZE_MAX. If it can not, and the calloc() call doesn't itself make this check, it would result in a short allocation and subsequent buffer overflow. Users of hiredis who are unable to update may set the maxelements context option to a value small enough that no overflow is possible.

Database specific 
{
    "unresolved_ranges":  [
        {
            "cpes":  [
                "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "9.0"
                },
                {
                    "last_affected":  "9.0"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "debian:debian_linux"
        }
    ]
}
References

Affected packages

Git / github.com/redis/hiredis

Affected ranges

Type
GIT
Repo
https://github.com/redis/hiredis
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8d1bfac4640fe90cd6f800d09b7f53e886569b98
Fixed
76a7b10005c70babee357a7d0f2becf28ec7ed1e
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:redis:hiredis:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.0.1"
        }
    ],
    "source":  [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.0.1
v0.10.0
v0.10.1
v0.11.0
v0.12.0
v0.12.1
v0.13.0
v0.13.1
v0.13.2
v0.13.3
v0.14.0
v0.9.0
v0.9.1
v0.9.2
v1.*
v1.0.0
v1.0.0-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32765.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "2960801188689279389740907912361228292",
                "103680156091366763705168315892522468615",
                "313519843436751110082004899014515685551"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2021-32765-28fc1741",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/redis/hiredis/commit/76a7b10005c70babee357a7d0f2becf28ec7ed1e",
        "target":  {
            "file":  "test.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "179161735348210698687051920573265359593",
            "length":  581
        },
        "id":  "CVE-2021-32765-39e6d2f9",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/redis/hiredis/commit/76a7b10005c70babee357a7d0f2becf28ec7ed1e",
        "target":  {
            "file":  "hiredis.c",
            "function":  "createArrayObject"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "311195162694762926584360255253075821286",
                "34398200280396169294640070927249867179",
                "76188935927609120202871962455023382498",
                "186027357458498207079532665570846242970"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2021-32765-40ddc6e5",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/redis/hiredis/commit/76a7b10005c70babee357a7d0f2becf28ec7ed1e",
        "target":  {
            "file":  "hiredis.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "160136926384499477379751229509923238067",
            "length":  6546
        },
        "id":  "CVE-2021-32765-b253503e",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/redis/hiredis/commit/76a7b10005c70babee357a7d0f2becf28ec7ed1e",
        "target":  {
            "file":  "test.c",
            "function":  "test_reply_reader"
        }
    }
]
vanir_signatures_modified 
"2026-07-09T11:34:46Z"