CVE-2025-48367 — Allocation of Resources Without Limits or Throttling in Redis

CWE-770 — Allocation of Resources Without Limits or Throttling5 documents5 sources
Severity
7.5HIGHNVD
EPSS
0.1%
top 68.40%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
9
RedisLfprojects ValkeyDebian Redict+6 more
Timeline
PublishedJul 7
Latest updateJul 8

Description

Redis is an open source, in-memory database that persists on disk. An unauthenticated connection can cause repeated IP protocol errors, leading to client starvation and, ultimately, a denial of service. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages11 packages

▶NVDredis/redis7.0 — 7.2.10+3
▶debiandebian/redis< redict 7.3.5+ds-1 (forky)
▶Debianredis/redis< 5:6.0.16-1+deb11u7+3
▶CVEListV5redis/redis>= 7.0.0, < 7.2.10, >= 7.4-rc1, < 7.4.5, >= 8.0.0, < 8.0.3+2

Patches

Patch: github.com ↗

🔴Vulnerability Details

1
OSV
CVE-2025-48367: Redis is an open source, in-memory database that persists on disk↗2025-07-07
▶

📋Vendor Advisories

3
Microsoft
Redis DoS Vulnerability due to bad connection error handling↗2025-07-08
▶
Red Hat
redis: Redis Unauthenticated Denial of Service↗2025-07-07
▶
Debian
CVE-2025-48367: redict - Redis is an open source, in-memory database that persists on disk. An unauthenti...↗2025
▶
CVE-2025-48367 — Redis vulnerability | cvebase