CVE-2025-32023
highPriorität · verfolgen · 43EPSS 0.065 · 94. PerzentilExploit · PoCDEEURUUSEPSS · bewertet 2026-10-27
Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially leading to remote code execution. The bug likely affects all Redis versions with hyperloglog operations implemented. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing hyperloglog operations. This can be done using ACL to restrict HLL commands.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
Exploits (4)
Öffentlicher Proof-of-Concept- und Exploit-Code.
- EDB-52477Redis 8.0.2 - RCEPoC · exploit_db
- 44528zja/Blackash-CVE-2025-32023CVE-2025-32023PoC · poc_in_github
- LordBheem/CVE-2025-32023Exploit for CVE-2025-32023PoC · poc_in_github
betroffene Produkte (95)
Betroffene Produkte und Versionsbereiche.
Advisories (4)
Hersteller- und Ökosystem-Meldungen dazu.
- WID-SEC-W-2025-1463Redis: Mehrere SchwachstellenDeutsch2025-07-06csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Redis ausnutzen, um beliebigen Programmcode auszuführen, und um einen Denial of Service Angriff durchzuführen.
- BIT-keydb-2025-32023Redis allows out of bounds writes in hyperloglog commands leading to RCE2025-10-16vendor · osvUS
Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially leading to remote code execution. The bug likely affects all Redis versions with hyperloglog operations implemented. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing hyperloglog operations. This can be done using ACL to restrict HLL commands.
- BIT-redis-2025-32023Redis allows out of bounds writes in hyperloglog commands leading to RCE2025-10-16vendor · osvUS
Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially leading to remote code execution. The bug likely affects all Redis versions with hyperloglog operations implemented. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing hyperloglog operations. This can be done using ACL to restrict HLL commands.
- BIT-valkey-2025-32023Redis allows out of bounds writes in hyperloglog commands leading to RCE2025-10-16vendor · osvUS
Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially leading to remote code execution. The bug likely affects all Redis versions with hyperloglog operations implemented. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing hyperloglog operations. This can be done using ACL to restrict HLL commands.
auch bekannt als (7)
Weitere Namen und Kennungen dieser Entität.
- CNNVD-202507-709cnnvd
- EUVD-2025-20233enisa_euvd
- BDU:2025-08113fstec_bdu
- BIT-keydb-2025-32023osv
- BIT-redis-2025-32023osv
- BIT-valkey-2025-32023osv
- GHSA-rp2m-q4j6-gr43osv
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (22)
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/security/cve/cve-2025-32023cnnvd
- https://github.com/redis/redis/commit/50188747cbfe43528d2719399a2a3c9599169445cnnvd
- https://github.com/redis/redis/releasesPatchcnnvd
- https://github.com/redis/redis/releases/tag/6.2.19cnnvd
- https://github.com/redis/redis/releases/tag/7.2.10cnnvd
- https://github.com/redis/redis/releases/tag/7.4.5cnnvd
- https://github.com/redis/redis/releases/tag/8.0.3cnnvd
- https://github.com/redis/redis/security/advisories/GHSA-rp2m-q4j6-gr43cnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan