PT-2025-17641 · Redis+8 · Redis+8
Polaris-Alioth
·
Published
2025-04-23
·
Updated
2026-01-21
·
CVE-2025-21605
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Redis versions 2.6 through 7.4.2
Description
Redis is an open source, in-memory database that persists on disk. An unauthenticated client can cause unlimited growth of output buffers, until the server runs out of memory or is killed. By default, the Redis configuration does not limit the output buffer of normal clients. The output buffer can grow unlimitedly over time, exhausting the service and making memory unavailable. When password authentication is enabled on the Redis server, but no password is provided, the client can still cause the output buffer to grow from "NOAUTH" responses until the system will run out of memory.
Recommendations
For versions 2.6 through 7.4.2, update to version 7.4.3 to resolve the issue.
As a temporary workaround, consider blocking access to prevent unauthenticated users from connecting to Redis by using network access control tools like firewalls, iptables, security groups, etc, or enabling TLS and requiring users to authenticate using client side certificates.
Exploit
Fix
DoS
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Debian
Red Hat
Red Os
Redis
Rocky Linux
Suse