CVE-2025-32023highCWE-680

CVE-2025-32023: fallo de gravedad alta en redis

Redis allows out of bounds writes in hyperloglog commands leading to RCE

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear redis+ Monitorear redis

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

46Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 7epss 6.5%
de la publicación al armael mismo día
Publicada en NVD7 jul
1ª PoC6 jul
Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially leading to remote code execution. The bug likely affects all Redis versions with hyperloglog operations implemented. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing hyperloglog operations. This can be done using ACL to restrict HLL commands.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
redis · redis
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — redis

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-49844CRITICALRedis Lua Use-After-Free may lead to remote code executionEPSS 82.6%CVE-2023-36824HIGHHeap overflow in COMMAND GETKEYS and ACL evaluation in RedisEPSS 77.4%CVE-2023-22458MEDIUMInteger overflow in multiple Redis commands can lead to denial-of-serviceEPSS 72.0%CVE-2022-36021MEDIUMRedis string pattern matching can be abused to achieve Denial of ServiceEPSS 59.8%CVE-2023-28425MEDIUMSpecially crafted MSETNX command can lead to denial-of-serviceEPSS 58.5%CVE-2022-24834HIGHHeap overflow issue with the Lua cjson library used by RedisEPSS 41.4%