CVE-2022-36021: Redis string matching commands allow authenticated denial of service

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

medium priorityThe flaw is an authenticated denial of service with no confidentiality or integrity impact, but the high EPSS score and public patch make it worth prompt remediation.

What it is

Redis string matching commands such as SCAN and KEYS can be invoked with a specially crafted pattern that causes the server to hang and consume 100% CPU. The flaw is a resource consumption issue (CWE-407) fixed in Redis 6.0.18, 6.2.11 and 7.0.9. It matters because a single authenticated user can stall a shared in-memory database that many applications depend on.

Impact

An attacker with valid Redis credentials can drive the server to 100% CPU and hang it, denying service to all other clients and dependent applications. There is no data confidentiality or integrity impact; the effect is availability loss.

Attack surface

The flaw is reached through normal Redis commands (SCAN, KEYS) sent to the server, so it requires an authenticated connection but no user interaction. The CVSS vector AV:L/PR:L/UI:N reflects local access with low privileges, though any client able to issue commands can trigger it.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is high at 0.605 (99.1st percentile), indicating elevated predicted exploitation activity. The advisory and patch commits are public, so the technique is discoverable.

What to do

• Upgrade Redis to 6.0.18, 6.2.11, 7.0.9 or later; patched versions are the only complete fix.
• Restrict who can authenticate to Redis and avoid exposing the service to untrusted networks.
• Disable or rename dangerous commands such as KEYS where application requirements allow.
• Apply CPU and connection limits or timeouts so a single client cannot monopolize the server.
• Monitor for repeated SCAN or KEYS calls with unusual patterns from a single client.

Detection

• Alert on sustained Redis CPU near 100% correlated with SCAN or KEYS command activity.
• Use Redis slowlog or command monitoring to flag repeated SCAN/KEYS calls with complex or wildcard-heavy patterns.
• Baseline normal SCAN/KEYS usage per client and alert on deviations or bursts from one connection.
• Watch for client connections that remain open while the server stops responding to other clients.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.