A patch release of Redis DBMS 7.0.5 has been published, addressing the vulnerability (CVE-2022-35951) that potentially allows an attacker to execute their code with Redis process privileges. This issue affects only the 7.x branch and requires access to execute queries for the attack.
The vulnerability is caused by an integer overflow that occurs when specifying an incorrect value for the 'COUNT' parameter in the 'XAUTOCLAIM' command. When used in stream key commands under certain conditions, the integer overflow can be exploited to write outside the allocated memory heap.
Source: opennet.ru
