Critical Buffer Overflow Vulnerability in Redis Package: Potential Code Execution Risk
Summary
DEBIAN-CVE-2025-27151: Redis is an open source, in-memory database that persists on disk. Affects redict versions < 7.3.5+ds-1. Fixed in 7.3.5+ds-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Redis is an open-source, in-memory database that provides high performance and flexibility for data storage and retrieval. It is widely used for caching, session management, and real-time analytics due to its speed and ease of use. However, certain versions of Redis have been found to be vulnerable to a stack-based buffer overflow, which can lead to severe security risks.
Vulnerability Detail
The vulnerability arises from a stack-based buffer overflow in the redis-check-aof utility, present in Redis versions from 7.0.0 to before 8.0.2. This issue is caused by the improper use of the memcpy function, which copies a user-supplied file path into a fixed-size stack buffer without adequate size checks. An attacker can exploit this vulnerability to overflow the stack, potentially allowing for arbitrary code execution, which poses a significant risk to systems running affected versions of Redis.
How To Fix
Minimum fixed version
7.3.5+ds-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade redictTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the redis-check-aof utility until they can upgrade to the patched version. Additionally, restricting access to the Redis server and implementing network security measures can help mitigate the risk of exploitation.
Conclusion
The Redis package has a critical vulnerability that could allow for code execution due to a stack-based buffer overflow. Users are strongly advised to upgrade to version 8.0.2 or later to mitigate this risk. Implementing security measures and using tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for redict →
FAQ
It is a stack-based buffer overflow vulnerability in the redis-check-aof utility that can lead to code execution.
Redis versions from 7.0.0 to before 8.0.2 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
As a temporary measure, avoid using the redis-check-aof utility and implement network security measures to limit access to the Redis server.
Yes, Vulert provides a solution that requires only a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for redict.
