CVE-2025-32023 Redis allows out of bounds writes in hyperloglog commands leading to RCE
An authenticated attacker can trigger out-of-bounds writes in Redis hyperloglog operations, potentially leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-32023?
CVE-2025-32023 is a high-severity memory corruption vulnerability in redis, published on 7 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially leading to remote code execution. The bug likely affects all Redis versions with hyperloglog operations implemented. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing hyperloglog operations. This can be done using ACL to restrict HLL commands.
Weakness: CWE-680
Which versions are affected by CVE-2025-32023?
3 open source packages ship an affected version, including redis, keydb and valkey. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
redis Bitnami | From 2.8.0 | 6.2.19, 7.2.10, 8.0.3, 7.4.5 |
keydb Bitnami | From 2.8.0 | 6.2.19, 7.2.10, 8.0.3, 7.4.5 |
valkey Bitnami | All versions | 7.2.10, 8.0.4, 8.1.3 |
Products include Redis Redis.
How do I fix CVE-2025-32023?
Upgrade redis to a fixed version for your release line: 6.2.19, 7.2.10, 8.0.3 or 7.4.5.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-32023 being exploited?
There is no known exploitation of CVE-2025-32023 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry and 2 proofs of concept on GitHub.
Other vulnerabilities in redis
- CVE-2022-0543 Debian-specific Redis Server Lua Sandbox Escape
- CVE-2026-23479 redis-server use-after-free in unblock client flow may allow remote code execution
- CVE-2026-25243 redis-server RESTORE invalid memory access may allow remote code execution
- CVE-2025-62507 Redis: Bug in XACKDEL may lead to stack overflow and potential RCE
- CVE-2025-48367 Redis DoS Vulnerability due to bad connection error handling
Sources
Also known as ALPINE-CVE-2025-32023, AZL-64806, AZL-64824, BELL-CVE-2025-32023, BIT-keydb-2025-32023, BIT-redis-2025-32023 and 11 more.