INFSA-2025:12008: redis:7 security update

Information about definition

Identificator: INFSA-2025:12008

Type: security

Release date: 2025-08-05 12:59:03 UTC

Information about package

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.

Vulnerabilities description

  • CVE-2025-32023

    Redis could allow a local authenticated attacker to execute arbitrary code on the system, caused by an out-of-bounds write flaw in hyperloglog commands.

  • CVE-2025-48367

    Redis is vulnerable to a denial of service, caused by a bad connection error handling.

  • CVE-2025-27151

    Redis is vulnerable to a denial of service, caused by a stack-based buffer overflow in redis-check-aof due to the use of memcpy with strlen(filepath) when copying a user-supplied file path into a fixed-size stack buffer. This allows an attacker to overflow the stack and possibly achieve code execution.

Severity level

CVE Score CVSS 2.0 Score CVSS 3.x Score CVSS 4.0
no information 2.5 no information
no information 8.8 no information
no information 5.3 no information
Critical, important, moderate, low

Updated packages