CVE-2022-36021

MEDIUM Year: 2022
CVSS v3 Score
5.5
Medium
Weakness Type
CWE-407
View all →

Vulnerability Description

Redis is an in-memory database that persists on disk. Authenticated users can use string matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. The problem is fixed in Redis versions 6.0.18, 6.2.11, 7.0.9.

Related Vulnerabilities

CVE-2024-29916

MEDIUM
CVSS:5.6(Medium)

The dormakaba Saflok system before the November 2023 software update allows an attacker to unlock arbitrary doors at a property via forged keycards, if the attacker has obtained one active or expired ...

CWE-4072024

CVE-2020-27223

MEDIUM
CVSS:5.3(Medium)

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameter...

CWE-4072020

CVE-2020-3548

MEDIUM
CVSS:5.3(Medium)

A vulnerability in the Transport Layer Security (TLS) protocol implementation of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attack...

CWE-4072020

CVE-2024-12133

MEDIUM
CVSS:5.3(Medium)

A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much longer than expected, which can slow down ...

CWE-4072024

CVE-2024-12243

MEDIUM
CVSS:5.3(Medium)

A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certificate data can take excessive time, lead...

CWE-4072024

CVE-2025-23020

MEDIUM
CVSS:5.3(Medium)

An issue was discovered in Kwik before 0.10.1. A hash collision vulnerability (in the hash table used to manage connections) allows remote attackers to cause a considerable CPU load on the server (a H...

CWE-4072025