rubbxalc/cve-2021-32675Functional DoS exploit for CVE-2021-32675 in Redis, leveraging oversized bulk string headers to trigger memory exhaustion. Includes usage instructions and Docker-based testing environment.
This repository contains a functional exploit for CVE-2021-32675, a denial-of-service (DoS) vulnerability in Redis. The flaw allows unauthenticated remote attackers to trigger massive memory pre-allocations on the Redis server by sending oversized bulk string headers without providing argument data, leading to memory exhaustion and service crash.
CVE-2021-32675 is a vulnerability in Redis query buffer handling. When parsing incoming commands in the RESP (REdis Serialization Protocol) protocol, Redis reads the declared length of a bulk string argument ($<length>\r\n) and immediately pre-allocates an SDS (Simple Dynamic String) buffer in memory to receive the payload before reading any argument bytes.
Because this pre-allocation occurs before receiving the argument payload, an unauthenticated client can declare the maximum permitted bulk string size (by default, proto-max-bulk-len is 512 MB) and hold the connection open indefinitely without transmitting the actual data. Redis retains the pre-allocated memory for each active connection, creating an amplification ratio of approximately 32,000,000× (~16 bytes of network traffic results in a 512 MB memory reservation).
Opening multiple concurrent connections using this header-only technique quickly exhausts available server memory, causing:
maxmemory policy is active.OOM command not allowedThe vulnerability affects Redis versions prior to:
Redis instances running without authentication (requirepass not configured) or with default proto-max-bulk-len (512 MB) are vulnerable to this exploit. Patched versions enforce a strict 16 KB protocol buffer limit for unauthenticated clients before pre-allocation takes place.
python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
Python 3.8+
Vulnerable Redis instance (versions prior to 6.2.6 / 6.0.16 or unauthenticated instances)
python3 exploit.py --host <IP> --port <PORT> [options]
| Option | Type | Default | Description |
|---|---|---|---|
--host | str | Required | Target Redis hostname or IP address |
--port | int | 6379 | Port number |
--connections | int | 10 | Number of malicious connections to open |
--size | int | 512 | Declared bulk string buffer size in MB |
--hold | int | 5 | Seconds to hold connections open before cleanup |
--password, --auth | str | None | Password for Redis authentication (if needed) |
python3 exploit.py --host 127.0.0.1 --port 6379 --connections 10 --size 512 --hold 5
You can launch a local test lab using the included Docker Compose configuration:
# Start vulnerable Redis (port 6380) and mitigated Redis (port 6381)
docker compose -f conf/docker-compose.yml up -d
# Test against the vulnerable instance
python3 exploit.py --host 127.0.0.1 --port 6380 --connections 10 --size 512
# Test against the mitigated instance
python3 exploit.py --host 127.0.0.1 --port 6381 --password "L4bS3cur3!2024" --connections 10 --size 512
# Stop the containers
docker compose -f conf/docker-compose.yml down
This Proof of Concept is provided for educational, research, and security verification purposes only. The author is not responsible for any misuse, damage, or unauthorized testing against systems without explicit permission.