onyx --cves cve-2022-31144

CVE-2022-31144

score: <0.1
cvss: 7.0
epss: 3.2%
published: 2022-07-19
kev added: —
first seen: 2026-10-21

Redis 7.x prior to 7.0.4 contains a heap overflow caused by a specially crafted XAUTOCLAIM command on a stream key in a specific state, letting attackers potentially execute remote code, exploit requires sending malicious XAUTOCLAIM command.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

2022-07-19 Published
2026-10-21 Tracked by Onyx
2026-10-21 Public PoC

Exploit availability

Public PoC flagged by vulnx; no direct exploit link among the citations.

Weaknesses

CWE-122 CWE-787

References 4

https://github.com/redis/redis/releases/tag/7.0.4
https://github.com/redis/redis/security/advisories/GHSA-96f7-42fg-2jrh
https://security.gentoo.org/glsa/202209-17
https://security.netapp.com/advisory/ntap-20220909-0002/