CVE-2025-62507
highPriorität · beachten · 48EPSS 0.075 · 94. PerzentilExploit · PoCDEEURUUSEPSS · bewertet 2026-10-27
Redis is an open source, in-memory database that persists on disk. In versions 8.2.0 and above, a user can run the XACKDEL command with multiple ID's and trigger a stack buffer overflow, which may potentially lead to remote code execution. This issue is fixed in version 8.2.3. To workaround this issue without patching the redis-server executable is to prevent users from executing XACKDEL operation. This can be done using ACL to restrict XACKDEL command.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.8–8.8
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
Exploits (1)
Öffentlicher Proof-of-Concept- und Exploit-Code.
- GartonChan/redis-cve-2025-62507GartonChan/redis-cve-2025-62507PoC · poc_in_github
betroffene Produkte (9)
Betroffene Produkte und Versionsbereiche.
Advisories (3)
Hersteller- und Ökosystem-Meldungen dazu.
- WID-SEC-W-2025-2469Redis: Schwachstelle ermöglicht CodeausführungDeutsch2025-11-02csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Redis ausnutzen, um beliebigen Programmcode auszuführen.
- BIT-keydb-2025-62507Redis: Bug in XACKDEL may lead to stack overflow and potential RCE2025-11-07vendor · osvUS
Redis is an open source, in-memory database that persists on disk. In versions 8.2.0 and above, a user can run the XACKDEL command with multiple ID's and trigger a stack buffer overflow, which may potentially lead to remote code execution. This issue is fixed in version 8.2.3. To workaround this issue without patching the redis-server executable is to prevent users from executing XACKDEL operation. This can be done using ACL to restrict XACKDEL command.
- BIT-redis-2025-62507Redis: Bug in XACKDEL may lead to stack overflow and potential RCE2025-11-07vendor · osvUS
Redis is an open source, in-memory database that persists on disk. In versions 8.2.0 and above, a user can run the XACKDEL command with multiple ID's and trigger a stack buffer overflow, which may potentially lead to remote code execution. This issue is fixed in version 8.2.3. To workaround this issue without patching the redis-server executable is to prevent users from executing XACKDEL operation. This can be done using ACL to restrict XACKDEL command.
auch bekannt als (6)
Weitere Namen und Kennungen dieser Entität.
- CNNVD-202511-118cnnvd
- EUVD-2025-37903enisa_euvd
- BDU:2025-15613fstec_bdu
- BIT-keydb-2025-62507osv
- BIT-redis-2025-62507osv
- GHSA-jhjx-x4cf-4vm8osv
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (12)
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/security/cve/cve-2025-62507cnnvd
- https://github.com/redis/redis/commit/5f83972188f6e5b1d6f1940218c650a9cbdf7741cnnvd
- https://github.com/redis/redis/releasesPatchcnnvd
- https://github.com/redis/redis/releases/tag/8.2.3cnnvd
- https://github.com/redis/redis/security/advisories/GHSA-jhjx-x4cf-4vm8cnnvd
- https://vigilance.fr/vulnerability/Redis-buffer-overflow-via-XACKDEL-STREAMID-STATIC-VECTOR-LEN-48641cnnvd
- https://github.com/redis/redis/commit/5f83972188f6e5b1d6f1940218c650a9cbdf7741enisa_euvd
- https://github.com/redis/redis/releases/tag/8.2.3enisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan