CVE-2022-35951

Deeper analysis

Redis versions 7.0.0 through 7.0.4 contain an integer overflow vulnerability in the XAUTOCLAIM command when executed against a stream key in a specific state using a crafted COUNT argument. The flaw, tracked as CWE-190, produces a subsequent heap overflow that can result in remote code execution. The issue was assigned a CVSS 3.1 score of 7.0 reflecting local attack vector, high complexity, and high impact on confidentiality, integrity, and availability.

An authenticated local attacker who can execute Redis commands can trigger the overflow to corrupt heap memory and potentially gain arbitrary code execution on the Redis process. No special user interface interaction is required, though the attack complexity is rated high because the target stream must be in a particular state.

Official advisories from the Redis project and downstream distributions such as Fedora and Gentoo state that the vulnerability is resolved in version 7.0.5; the project reports no known workarounds. NetApp has also published an advisory confirming the affected status of certain products and directing customers to the upstream fix.

EPSS for the CVE rose from a low baseline after disclosure to a peak of 0.7885 on 2025-12-11 before receding to the current value of 0.1865, indicating that exploitation interest increased substantially post-release.