Summary
Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.
Security Fix(es):
* redis: Redis Unauthenticated Denial of Service (CVE-2025-48367)
* redis: Redis Hyperloglog Out-of-Bounds Write Vulnerability (CVE-2025-32023)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | redis | 6.2.19-1.module_el8.10.0+4030+0c7fcc00 |
| AlmaLinux · 8 | redis-devel | 6.2.19-1.module_el8.10.0+4030+0c7fcc00 |
| AlmaLinux · 8 | redis-doc | 6.2.19-1.module_el8.10.0+4030+0c7fcc00 |
Vulnerabilities 2
-
High 7.5
Redis DoS Vulnerability due to bad connection error handling
Redis is an open source, in-memory database that persists on disk. An unauthenticated connection can cause repeated IP protocol errors, leading to client starvation and, ultimately, a denial of service. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and…
-
High 7.0CVE-2025-32023 Public exploit
Redis allows out of bounds writes in hyperloglog commands leading to RCE
Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially…