CVE-2023-28425 Specially crafted MSETNX command can lead to denial-of-service

What is CVE-2023-28425?

CVE-2023-28425 is a medium-severity denial of service vulnerability in redis, published on 20 Mar 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in Redis version 7.0.10.

Weakness: CWE-617, CWE-77

Which versions are affected by CVE-2023-28425?

3 open source packages ship an affected version, including redis, keydb and valkey. It affects 1 product.

Products include Redis Redis.

How do I fix CVE-2023-28425?

Upgrade redis to 7.0.10 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-28425 being exploited?

There is no known exploitation of CVE-2023-28425 in the wild and no public exploit code.

Other vulnerabilities in redis

• CVE-2022-0543 Debian-specific Redis Server Lua Sandbox Escape Exploited Critical 10.0
• CVE-2026-23479 redis-server use-after-free in unblock client flow may allow remote code execution High 7.7
• CVE-2026-25243 redis-server RESTORE invalid memory access may allow remote code execution High 7.7
• CVE-2025-62507 Redis: Bug in XACKDEL may lead to stack overflow and potential RCE High 7.7
• CVE-2025-48367 Redis DoS Vulnerability due to bad connection error handling High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-25674, BIT-keydb-2023-28425, BIT-redis-2023-28425, BIT-valkey-2023-28425, DEBIAN-CVE-2023-28425, GHSA-mvmm-4vq6-vw8c.