PT-2025-23146 · Redis+7 · Redis+7
Simcha Kosman
·
Published
2025-05-29
·
Updated
2025-11-28
·
CVE-2025-27151
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Redis versions 7.0.0 through 8.0.2
Description
Redis is an open source, in-memory database that persists on disk. A stack-based buffer overflow exists in redis-check-aof due to the use of memcpy with strlen(filepath) when copying a user-supplied file path into a fixed-size stack buffer. This allows an attacker to overflow the stack and potentially achieve code execution. The issue has been patched in version 8.0.2.
Recommendations
For versions 7.0.0 through 8.0.2, update to version 8.0.2 to resolve the issue.
As a temporary workaround, consider disabling the redis-check-aof function until a patch is available.
Restrict access to the vulnerable redis-check-aof module to minimize the risk of exploitation.
Avoid using the
filepath variable in the affected redis-check-aof function until the issue is resolved.Exploit
Fix
RCE
DoS
Stack Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Debian
Red Hat
Red Os
Redis
Rocky Linux
Suse