Critical Buffer Overflow Vulnerability in Redis Package: CVE-2025-27151
Summary
ALPINE-CVE-2025-27151: Redis is an open source, in-memory database that persists on disk. Affects redis versions < 7.0.15-r4. Fixed in 7.0.15-r4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Redis is an open-source, in-memory database renowned for its speed and efficiency in data storage and retrieval. It supports various data structures such as strings, hashes, lists, sets, and more. Redis is widely used for caching, session management, and real-time analytics. However, versions from 7.0.0 to before 8.0.2 are susceptible to a critical buffer overflow vulnerability that can lead to severe security risks.
Vulnerability Detail
The vulnerability arises from a stack-based buffer overflow in the redis-check-aof utility due to improper handling of user-supplied file paths. Specifically, the use of memcpy with strlen(filepath) allows an attacker to overflow the stack, potentially leading to arbitrary code execution. This issue poses significant risks, as it can be exploited to execute malicious code on the server running Redis, compromising the integrity and confidentiality of the data stored.
How To Fix
Minimum fixed version
7.0.15-r4
This is the first release that contains the fix.
sudo apk add --upgrade redisTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit access to the redis-check-aof utility and ensure that only trusted users can execute it. Additionally, monitoring logs for unusual activities can help mitigate potential exploitation until the package is updated.
Conclusion
The CVE-2025-27151 vulnerability in Redis poses a significant threat to users running affected versions. It is crucial to update to the patched versions as soon as possible to mitigate risks of exploitation. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for redis →
FAQ
CVE-2025-27151 is a critical buffer overflow vulnerability found in Redis versions 7.0.0 to before 8.0.2, which can allow attackers to execute arbitrary code.
You can check if your Redis installation is affected by using the Vulert playground at Vulert Scanner, which analyzes your manifest file for vulnerabilities.
Exploitation of this vulnerability can lead to arbitrary code execution, potentially compromising the entire server and the data it holds.
The CVSS score for this vulnerability is 9.8, indicating a critical level of severity.
You can update Redis by using the command apk add redis@<version> where <version> corresponds to the patched version for your Alpine Linux distribution.
References
Related vulnerabilities
Recent vulnerabilities recorded for redis.
