sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2025-21605 Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client

High 7.5 Published Updated

Unauthenticated clients can exhaust server memory by causing unlimited output buffer growth, leading to service denial.

Exploited in the wild
Not known
Login needed
Not needed
Attackable
Over the internet
Victim action needed
Not needed
Fix
Available

What is CVE-2025-21605?

CVE-2025-21605 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 23 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Redis is an open source, in-memory database that persists on disk. In versions starting at 2.6 and prior to 7.4.3, An unauthenticated client can cause unlimited growth of output buffers, until the server runs out of memory or is killed. By default, the Redis configuration does not limit the output buffer of normal clients (see client-output-buffer-limit). Therefore, the output buffer can grow unlimitedly over time. As a result, the service is exhausted and the memory is unavailable. When password authentication is enabled on the Redis server, but no password is provided, the client can still cause the output buffer to grow from "NOAUTH" responses until the system will run out of memory. This issue has been patched in version 7.4.3. An additional workaround to mitigate this problem without patching the redis-server executable is to block access to prevent unauthenticated users from connecting to Redis. This can be done in different ways. Either using network access control tools like firewalls, iptables, security groups, etc, or enabling TLS and requiring users to authenticate using client side certificates.

Weakness: CWE-770

Which versions are affected by CVE-2025-21605?

3 open source packages ship an affected version, including keydb, redis and valkey. It affects 3 products.

PackageAffectedFixed in
keydb BitnamiFrom 2.6.06.2.18, 7.2.8, 7.4.3
redis BitnamiFrom 2.6.06.2.18, 7.2.8, 6.2.18, 7.2.8, 7.4.3
valkey BitnamiAll versions7.2.9, 8.0.3, 8.1.1
Linux distribution packages (37)
valkey AlmaLinux:10All versions8.0.3-1.el10_0
valkey-devel AlmaLinux:10All versions8.0.3-1.el10_0
redis AlmaLinux:8All versions6.2.18-1.module_el8.10.0+3994+c2cc5395
redis-devel AlmaLinux:8All versions6.2.18-1.module_el8.10.0+3994+c2cc5395
redis-doc AlmaLinux:8All versions6.2.18-1.module_el8.10.0+3994+c2cc5395
redis AlmaLinux:9All versions6.2.18-1.el9_6
redis AlmaLinux:9All versions7.2.8-1.module_el9.6.0+168+b8d8e900
redis-devel AlmaLinux:9All versions6.2.18-1.el9_6
redis-devel AlmaLinux:9All versions7.2.8-1.module_el9.6.0+168+b8d8e900
redis-doc AlmaLinux:9All versions6.2.18-1.el9_6
redis-doc AlmaLinux:9All versions7.2.8-1.module_el9.6.0+168+b8d8e900
discovery-cli Red Hat:discovery:1.0::el8All versions0:1.14.0-1.el8
discovery-installer Red Hat:discovery:1.0::el8All versions0:1.14.1-1.el8
discovery-cli Red Hat:discovery:1.0::el9All versions0:1.14.0-1.el9
discovery-installer Red Hat:discovery:1.0::el9All versions0:1.14.1-1.el9
valkey Red Hat:enterprise_linux:10.0All versions0:8.0.3-1.el10_0
valkey-debuginfo Red Hat:enterprise_linux:10.0All versions0:8.0.3-1.el10_0
valkey-debugsource Red Hat:enterprise_linux:10.0All versions0:8.0.3-1.el10_0
valkey-devel Red Hat:enterprise_linux:10.0All versions0:8.0.3-1.el10_0
redis Red Hat:enterprise_linux:8::appstreamAll versions0:6.2.18-1.module+el8.10.0+23050+05ea4e95
redis-debuginfo Red Hat:enterprise_linux:8::appstreamAll versions0:6.2.18-1.module+el8.10.0+23050+05ea4e95
redis-debugsource Red Hat:enterprise_linux:8::appstreamAll versions0:6.2.18-1.module+el8.10.0+23050+05ea4e95
redis-devel Red Hat:enterprise_linux:8::appstreamAll versions0:6.2.18-1.module+el8.10.0+23050+05ea4e95
redis-doc Red Hat:enterprise_linux:8::appstreamAll versions0:6.2.18-1.module+el8.10.0+23050+05ea4e95
redis Red Hat:enterprise_linux:9::appstreamAll versions0:6.2.18-1.el9_6
redis Red Hat:enterprise_linux:9::appstreamAll versions0:7.2.8-1.module+el9.6.0+23049+8374f320
redis-debuginfo Red Hat:enterprise_linux:9::appstreamAll versions0:6.2.18-1.el9_6
redis-debuginfo Red Hat:enterprise_linux:9::appstreamAll versions0:7.2.8-1.module+el9.6.0+23049+8374f320
redis-debugsource Red Hat:enterprise_linux:9::appstreamAll versions0:6.2.18-1.el9_6
redis-debugsource Red Hat:enterprise_linux:9::appstreamAll versions0:7.2.8-1.module+el9.6.0+23049+8374f320
redis-devel Red Hat:enterprise_linux:9::appstreamAll versions0:6.2.18-1.el9_6
redis-devel Red Hat:enterprise_linux:9::appstreamAll versions0:7.2.8-1.module+el9.6.0+23049+8374f320
redis-doc Red Hat:enterprise_linux:9::appstreamAll versions0:6.2.18-1.el9_6
redis-doc Red Hat:enterprise_linux:9::appstreamAll versions0:7.2.8-1.module+el9.6.0+23049+8374f320
redis Red Hat:rhel_aus:8.4::appstreamAll versions0:6.0.9-5.module+el8.4.0+23067+0d16e377.2
redis-debuginfo Red Hat:rhel_aus:8.4::appstreamAll versions0:6.0.9-5.module+el8.4.0+23067+0d16e377.2
redis-debugsource Red Hat:rhel_aus:8.4::appstreamAll versions0:6.0.9-5.module+el8.4.0+23067+0d16e377.2

Products include Debian Debian Linux, Lfprojects Valkey, Redis Redis.

How do I fix CVE-2025-21605?

Upgrade keydb to a fixed version for your release line: 6.2.18, 7.2.8 or 7.4.3.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-21605 being exploited?

There is no known exploitation of CVE-2025-21605 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as ALPINE-CVE-2025-21605, ALSA-2025:7429, ALSA-2025:7438, ALSA-2025:7509, ALSA-2025:7686, AZL-60939 and 39 more.

Is CVE-2025-21605 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free