PT-2025-12366 · Go-Redis+2 · Go-Redis+2
Published
2025-03-20
·
Updated
2026-06-10
·
CVE-2025-29923
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
go-redis versions prior to 9.5.5
go-redis versions prior to 9.6.3
go-redis versions prior to 9.7.3
Description
The issue occurs when
CLIENT SETINFO times out during connection establishment, potentially causing out-of-order responses. This can happen due to network connectivity issues, aggressive timeouts, or when the client is configured to transmit its identity. The problem affects multiple use cases, including sticky connections, where persistent out-of-order responses are received for the lifetime of the connection, and all commands in the pipeline receive incorrect responses. When used with the default ConnPool, at most one out-of-order response is received before the connection is discarded.Recommendations
For versions prior to 9.5.5, update to version 9.5.5 or later.
For versions prior to 9.6.3, update to version 9.6.3 or later.
For versions prior to 9.7.3, update to version 9.7.3 or later.
As a temporary workaround, consider setting the
DisableIdentity flag to true when constructing the client instance to prevent the vulnerability.Exploit
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Suse
Go-Redis