Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially leading to remote code execution. The bug likely affects all Redis versions with hyperloglog operations implemented. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing hyperloglog operations. This can be done using ACL to restrict HLL commands.
CVSS Details
- CVSS 3.1 Base Score: 7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade redisUpgrade redis-develUpgrade redis-doc | Jul 31, 2025 | Jul 28, 2025 |
| Alpine Linux | — | Upgrade redisUpgrade valkeyUpgrade redict | Aug 8, 2025 | Jul 7, 2025 |
| Amazon Linux Ami 2 | — | Upgrade redis-develUpgrade redisUpgrade redis-docUpgrade redis-debuginfo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade valkey-debugsourceUpgrade redis6-debugsourceUpgrade redis6-develUpgrade valkey-debuginfoUpgrade valkey-develUpgrade valkeyUpgrade redis6-debuginfoUpgrade redis6-docUpgrade redis6 | Jul 11, 2025 | Jul 7, 2025 |
| Debian | — | Upgrade redisUpgrade valkey | Jul 9, 2025 | Jul 7, 2025 |
| Freebsd | — | Upgrade redis62Upgrade valkeyUpgrade redis74Upgrade redis72Upgrade redis | Jul 8, 2025 | Jul 7, 2025 |
| Gentoo Linux | — | Upgrade dev-db/redict.Upgrade dev-db/redis. | Nov 25, 2025 | Nov 24, 2025 |
| Oracle_linux | — | Upgrade redisUpgrade redis-develUpgrade valkey-develUpgrade redis-docUpgrade valkey | Jul 22, 2025 | Jul 7, 2025 |
| Redhat_linux | — | Upgrade redis-debuginfoUpgrade redis-docUpgrade valkey-debugsourceUpgrade valkey-develUpgrade redisUpgrade redis-debugsourceUpgrade valkeyUpgrade redis-develUpgrade valkey-debuginfo | Jul 15, 2025 | Jul 7, 2025 |
| Redislabs Redis | — | Upgrade RedisLabs Redis to version 8.0.3Upgrade RedisLabs Redis to version 6.2.19Upgrade RedisLabs Redis to version 7.2.10Upgrade RedisLabs Redis to version 7.4.5 | Apr 17, 2026 | Jul 7, 2025 |
| Rocky_linux | — | Upgrade redis-debugsourceUpgrade redis-debuginfoUpgrade valkey-develUpgrade valkey-debuginfoUpgrade valkey-debugsourceUpgrade valkeyUpgrade redisUpgrade redis-devel | Feb 5, 2026 | Oct 4, 2025 |
| Suse | — | Upgrade valkey-develUpgrade redis7Upgrade valkey-compat-redisUpgrade valkeyUpgrade redis | Dec 5, 2025 | Jul 23, 2025 |
| Ubuntu | — | Upgrade redisUpgrade redis-server | Mar 19, 2026 | Jul 7, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 9, 2026 | Jul 7, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub