Description
Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem is fixed in Redis 7.2.7 and 7.4.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| redis | redis | >= 7.0.0, < 7.2.7, >= 7.4.0, < 7.4.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | redis | 5:7.0.15-3 | — |
| Debian 14 | valkey | 8.0.2+dfsg1-1 | — |
| Debian 13 | redis | 5:7.0.15-3 | — |
| Debian 13 | valkey | 8.0.2+dfsg1-1 | — |
| Debian 12 | redis | 5:7.0.15-1~deb12u3 | DSA-5856-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | redict | No fix yet | — |
| Ubuntu 26.04 LTS | redict | No fix yet | — |
| Ubuntu 25.10 | redict | No fix yet | — |
| Ubuntu 24.04 LTS | redis | 5:7.0.15-1ubuntu0.24.04.1 | USN-7321-1 |
| Ubuntu 24.04 LTS | valkey | 7.2.8+dfsg1-0ubuntu0.24.04.2 | USN-7359-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | redis | 5:6.0.16-1ubuntu1+esm2 | USN-7321-1 |
| Ubuntu Pro 20.04 LTS | redis | 5:5.0.7-2ubuntu0.1+esm3 | USN-7321-1 |
| Ubuntu Pro 18.04 LTS | redis | 5:4.0.9-1ubuntu0.2+esm5 | USN-7321-1 |
| Ubuntu Pro 16.04 LTS | redis | 2:3.0.6-1ubuntu0.4+esm3 | USN-7321-1 |
| Ubuntu Pro 14.04 LTS | redis | 2:2.8.4-2ubuntu0.2+esm4 | USN-7321-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | redis +2 | 7.2.7-1.module+el9.5.0+22705+3d861c1c | RHSA-2025:0692 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | redis +2 | 7.2.7-1.module_el9.5.0+134+2e645600 | ALSA-2025:0692 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | redis | 7.2.4-150600.3.6.1 | SUSE-SU-2025:0163-1 |
| SLES 15 SP6 | redis7 | 7.0.8-150600.8.6.1 | SUSE-SU-2025:0161-1 |
| SLES 15 SP5 | redis7 | 7.0.8-150500.3.15.1 | SUSE-SU-2025:0160-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP5 | redis7 | 7.0.8-150500.3.15.1 | SUSE-SU-2025:0160-1 |
| SLE HPC 15 SP5 | redis7 | 7.0.8-150500.3.15.1 | SUSE-SU-2025:0160-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | redis +1 | 8.0.2-1.1 | openSUSE-SU-2025:15293-1, openSUSE-SU-2025:14638-1 |
| openSUSE Leap 15.6 | redis | 7.2.4-150600.3.6.1 | SUSE-SU-2025:0163-1 |
| openSUSE Leap 15.6 | redis7 | 7.0.8-150600.8.6.1 | SUSE-SU-2025:0161-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | redict | 7.3.2-r0 | — |
| Alpine v3.24 | redis | 7.2.7-r0 | — |
| Alpine v3.24 | valkey | 7.2.8-r0 | — |
| Alpine v3.23 | redict | 7.3.2-r0 | — |
| Alpine v3.23 | redis | 7.2.7-r0 | — |
| Alpine v3.23 | valkey | 7.2.8-r0 | — |
| Alpine v3.22 | redict | 7.3.2-r0 | — |
| Alpine v3.22 | redis | 7.2.7-r0 | — |
| Alpine v3.22 | valkey | 7.2.8-r0 | — |
| Alpine v3.21 | redict | 7.3.2-r0 | — |
| Alpine v3.21 | redis | 7.2.7-r0 | — |
| Alpine v3.21 | valkey | 7.2.8-r0 | — |
| Alpine v3.20 | redict | 7.3.2-r0 | — |
| Alpine v3.20 | redis | 7.2.7-r0 | — |
| Alpine v3.20 | valkey | 7.2.8-r0 | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | redis | 7.2.7-r0 | — |
| Alpine v3.18 | redis | 7.0.15-r2 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | valkey | 8.0.2-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | redis +2 | 7.2.7-1.module+el9.5.0+90492+80cb7599 | ELSA-2025-0692 |
Advisories 12
- ALSA-2025:0692 Important: redis:7 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:0692 Red Hat Security Advisory: redis:7 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- USN-7321-1 redis vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-7359-1 valkey vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- openSUSE-SU-2025:15293-1 redis-8.0.2-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- DSA-5856-1 redis - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2025:0161-1 Security update for redis7 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0160-1 Security update for redis7 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:14638-1 valkey-8.0.2-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0163-1 Security update for redis SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-0017 Redis: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 14, 2026
- ELSA-2025-0692 Important: redis:7 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jan 27, 2025