A heap overflow issue was found in Redis in versions before 5.0.10, before 6.0.9 and before 6.2.0 when using a heap allocator other than jemalloc or glibc's malloc, leading to potential out of bound write or process crash. Effectively this flaw does not affect the vast majority of users, who use jemalloc or glibc malloc.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017408 advisory.

    A heap overflow issue was found in Redis in versions before 5.0.10, before 6.0.9 and before 6.2.0 when     using a heap allocator other than jemalloc or glibc's malloc, leading to potential out of bound write or     process crash. Effectively this flaw does not affect the vast majority of users, who use jemalloc or glibc     malloc.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A heap overflow issue was found in Redis in versions before 5.0.10, before 6.0.9 and before 6.2.0 when     using a heap allocator other than jemalloc or glibc's malloc, leading to potential out of bound write or     process crash. Effectively this flaw does not affect the vast majority of users, who use jemalloc or glibc     malloc. (CVE-2021-3470)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the redis package has been released.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A heap overflow issue was found in Redis in versions before 5.0.10, before 6.0.9 and before 6.2.0 when
    using a heap allocator other than jemalloc or glibc's malloc, leading to potential out of bound write or
    process crash. Effectively this flaw does not affect the vast majority of users, who use jemalloc or glibc
    malloc. (CVE-2021-3470)

  - Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an
    integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and
    potentially result with remote code execution. Redis 4.0 or newer uses a configurable limit for the
    maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the
    limit is significantly increased, receiving a large request from a client may trigger several integer
    overflow scenarios, which would result with buffer overflow and heap corruption. We believe this could in
    certain conditions be exploited for remote code execution. By default, authenticated Redis users have
    access to all configuration parameters and can therefore use the “CONFIG SET proto-max-bulk-len” to change
    the safe default, making the system vulnerable. **This problem only affects 32-bit Redis (on a 32-bit
    system, or as a 32-bit executable running on a 64-bit system).** The problem is fixed in version 6.2, and
    the fix is back ported to 6.0.11 and 5.0.11. Make sure you use one of these versions if you are running
    32-bit Redis. An additional workaround to mitigate the problem without patching the redis-server
    executable is to prevent clients from directly executing `CONFIG SET`: Using Redis 6.0 or newer, ACL
    configuration can be used to block the command. Using older versions, the `rename-command` configuration
    directive can be used to rename the command to a random string unknown to users, rendering it
    inaccessible. Please note that this workaround may have an additional impact on users or operational
    systems that expect `CONFIG SET` to behave in certain ways. (CVE-2021-21309)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A heap overflow issue was found in Redis in versions before 5.0.10, before 6.0.9 and before 6.2.0 when
    using a heap allocator other than jemalloc or glibc's malloc, leading to potential out of bound write or
    process crash. Effectively this flaw does not affect the vast majority of users, who use jemalloc or glibc
    malloc. (CVE-2021-3470)

ID	Name	Product	Family	Severity
313765	Unity Linux 20.1060e / 20.1070e Security Update: redis (UTSA-2026-017408)	Nessus	Unity Linux Local Security Checks	medium
246392	Linux Distros Unpatched Vulnerability : CVE-2021-3470	Nessus	Misc.	medium
204322	Photon OS 4.0: Redis PHSA-2021-4.0-0008	Nessus	PhotonOS Local Security Checks	medium
406913	Alpine: multiple redis packages: security update to 6.2.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
406913	Alpine: multiple redis packages: security update to 6.2.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
406912	Alpine: multiple redis packages: security update to 6.0.9-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
406912	Alpine: multiple redis packages: security update to 6.0.9-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
406900	Alpine: multiple redis packages: security update to 5.0.11-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
406900	Alpine: multiple redis packages: security update to 5.0.11-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
148824	Photon OS 2.0: Redis PHSA-2021-2.0-0336	Nessus	PhotonOS Local Security Checks	medium
148813	Photon OS 3.0: Redis PHSA-2021-3.0-0220	Nessus	PhotonOS Local Security Checks	medium
148809	Photon OS 1.0: Redis PHSA-2021-1.0-0380	Nessus	PhotonOS Local Security Checks	medium

Detections

Analytics

CVE-2021-3470

medium

Tenable Plugins

medium

medium

medium

high

high

medium

medium

high

high

medium

medium

medium