Stack-Based Buffer Overflow in Redis Check AOF - CVE-2025-27151
Summary
CVE-2025-27151: Redis is an open source, in-memory database that persists on disk. Affects redis across 3 version ranges.
< 7.0.15-r4
< 643b5db235cb82508e72f11c7b4bbfc7dc39be56
< 994bc96bb1744cb153392fc96bdba43eae56e17f
Fixed in 7.0.15-r4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Redis is an open-source, in-memory database known for its speed and efficiency in data storage and retrieval. It supports various data structures such as strings, hashes, lists, sets, and more. Redis is widely used for caching, real-time analytics, and as a message broker. However, versions from 7.0.0 to before 8.0.2 are vulnerable to a stack-based buffer overflow in the redis-check-aof utility, which can lead to severe security risks.
Vulnerability Detail
The vulnerability, identified as CVE-2025-27151, arises from the use of the memcpy function with the strlen(filepath) when copying a user-supplied file path into a fixed-size stack buffer. This flaw allows an attacker to overflow the stack, potentially leading to arbitrary code execution. The issue is particularly critical as it can be exploited remotely, allowing unauthorized access to the system running Redis.
How To Fix
Minimum fixed version
7.0.15-r4
This is the first release that contains the fix.
sudo apk add --upgrade redisTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit access to the redis-check-aof utility or restrict the execution of this tool until the package is updated. Additionally, ensure that only trusted users have access to the system running Redis.
Conclusion
CVE-2025-27151 represents a significant security risk for Redis users, particularly those using versions 7.0.0 to before 8.0.2. It is crucial to update to the latest version to mitigate this risk. Users are encouraged to monitor their systems and utilize tools like Vulert to stay informed about vulnerabilities.
See every vulnerability recorded for redis →
FAQ
CVE-2025-27151 is a vulnerability in Redis that allows for a stack-based buffer overflow, potentially leading to code execution.
Versions of Redis from 7.0.0 to before 8.0.2 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If immediate updates are not possible, restrict access to the redis-check-aof utility and ensure that only trusted users can execute it.
Yes, the vulnerability has been patched in Redis version 8.0.2 and later.
References
Related vulnerabilities
Recent vulnerabilities recorded for redis.
