CVE-2023-25155 Integer Overflow in several Redis commands can lead to denial of service.

What is CVE-2023-25155?

CVE-2023-25155 is a medium-severity vulnerability in redis, published on 2 Mar 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SRANDMEMBER`, `ZRANDMEMBER`, and `HRANDFIELD` commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. This problem affects all Redis versions. Patches were released in Redis version(s) 6.0.18, 6.2.11 and 7.0.9.

Weakness: CWE-190

Which versions are affected by CVE-2023-25155?

3 open source packages ship an affected version, including redis, keydb and valkey. It affects 1 product.

Products include Redis Redis.

How do I fix CVE-2023-25155?

Upgrade redis to a fixed version for your release line: 6.0.18, 6.2.11 or 7.0.9.

Is CVE-2023-25155 being exploited?

There is no known exploitation of CVE-2023-25155 in the wild and no public exploit code.

Other vulnerabilities in redis

• CVE-2022-0543 Debian-specific Redis Server Lua Sandbox Escape Exploited Critical 10.0
• CVE-2026-23479 redis-server use-after-free in unblock client flow may allow remote code execution High 7.7
• CVE-2026-25243 redis-server RESTORE invalid memory access may allow remote code execution High 7.7
• CVE-2025-62507 Redis: Bug in XACKDEL may lead to stack overflow and potential RCE High 7.7
• CVE-2025-48367 Redis DoS Vulnerability due to bad connection error handling High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-25354, BIT-keydb-2023-25155, BIT-redis-2023-25155, BIT-valkey-2023-25155, DEBIAN-CVE-2023-25155, GHSA-x2r7-j9vw-3w83 and 1 more.