Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially leading to remote code execution. The bug likely affects all Redis versions with hyperloglog operations implemented. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing hyperloglog operations. This can be done using ACL to restrict HLL commands.
CVSS Details
- CVSS 3.1 Base Score: 7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade redis-docUpgrade redis-develUpgrade redis | Jul 31, 2025 | Jul 28, 2025 |
| Alpine Linux | — | Upgrade valkeyUpgrade redictUpgrade redis | Aug 8, 2025 | Jul 7, 2025 |
| Amazon Linux Ami 2 | — | Upgrade redis-develUpgrade redis-debuginfoUpgrade redis-docUpgrade redis | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade redis6Upgrade redis6-debuginfoUpgrade valkey-debuginfoUpgrade valkeyUpgrade valkey-develUpgrade redis6-docUpgrade redis6-debugsourceUpgrade redis6-develUpgrade valkey-debugsource | Jul 11, 2025 | Jul 7, 2025 |
| Debian | — | Upgrade redisUpgrade valkey | Jul 9, 2025 | Jul 7, 2025 |
| Freebsd | — | Upgrade redis62Upgrade redis74Upgrade valkeyUpgrade redis72Upgrade redis | Jul 8, 2025 | Jul 7, 2025 |
| Gentoo Linux | — | Upgrade dev-db/redict.Upgrade dev-db/redis. | Nov 25, 2025 | Nov 24, 2025 |
| Oracle_linux | — | Upgrade redis-docUpgrade valkey-develUpgrade valkeyUpgrade redisUpgrade redis-devel | Jul 22, 2025 | Jul 7, 2025 |
| Redhat_linux | — | Upgrade redis-docUpgrade valkey-debugsourceUpgrade redis-debuginfoUpgrade redis-develUpgrade redisUpgrade valkey-debuginfoUpgrade valkey-develUpgrade valkeyUpgrade redis-debugsource | Jul 15, 2025 | Jul 7, 2025 |
| Redislabs Redis | — | Upgrade RedisLabs Redis to version 8.0.3Upgrade RedisLabs Redis to version 7.2.10Upgrade RedisLabs Redis to version 7.4.5Upgrade RedisLabs Redis to version 6.2.19 | Apr 17, 2026 | Jul 7, 2025 |
| Rocky_linux | — | Upgrade redis-develUpgrade valkey-debugsourceUpgrade valkeyUpgrade valkey-debuginfoUpgrade redisUpgrade redis-debuginfoUpgrade valkey-develUpgrade redis-debugsource | Feb 5, 2026 | Oct 4, 2025 |
| Suse | — | Upgrade valkeyUpgrade redisUpgrade valkey-compat-redisUpgrade redis7Upgrade valkey-devel | Dec 5, 2025 | Jul 23, 2025 |
| Ubuntu | — | Upgrade redis-serverUpgrade redis | Mar 19, 2026 | Jul 7, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 9, 2026 | Jul 7, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub