CVE-2025-48367 Redis DoS Vulnerability due to bad connection error handling

What is CVE-2025-48367?

CVE-2025-48367 is a high-severity denial of service vulnerability in redis, published on 7 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Redis is an open source, in-memory database that persists on disk. An unauthenticated connection can cause repeated IP protocol errors, leading to client starvation and, ultimately, a denial of service. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19.

Weakness: CWE-770

Which versions are affected by CVE-2025-48367?

3 open source packages ship an affected version, including redis, keydb and valkey. It affects 1 product.

Products include Redis Redis.

How do I fix CVE-2025-48367?

Upgrade redis to a fixed version for your release line: 6.2.19, 7.2.10, 8.0.3 or 7.4.5.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-48367 being exploited?

There is no known exploitation of CVE-2025-48367 in the wild and no public exploit code.

Other vulnerabilities in redis

• CVE-2022-0543 Debian-specific Redis Server Lua Sandbox Escape Exploited Critical 10.0
• CVE-2026-23479 redis-server use-after-free in unblock client flow may allow remote code execution High 7.7
• CVE-2026-25243 redis-server RESTORE invalid memory access may allow remote code execution High 7.7
• CVE-2025-62507 Redis: Bug in XACKDEL may lead to stack overflow and potential RCE High 7.7
• CVE-2023-31655 Denial of service in n/a High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2025-48367, AZL-64809, AZL-64827, BELL-CVE-2025-48367, BIT-keydb-2025-48367, BIT-redis-2025-48367 and 10 more.