Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially leading to remote code execution. The bug likely affects all Redis versions with hyperloglog operations implemented. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing hyperloglog operations. This can be done using ACL to restrict HLL commands.
CVSS Details
- CVSS 3.1 Base Score: 7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade redis-develUpgrade redis-docUpgrade redis | Jul 31, 2025 | Jul 28, 2025 |
| Alpine Linux | — | Upgrade redictUpgrade redisUpgrade valkey | Aug 8, 2025 | Jul 7, 2025 |
| Amazon Linux Ami 2 | — | Upgrade redis-debuginfoUpgrade redisUpgrade redis-docUpgrade redis-devel | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade redis6-develUpgrade valkey-debugsourceUpgrade redis6-debugsourceUpgrade redis6-debuginfoUpgrade valkeyUpgrade redis6Upgrade valkey-debuginfoUpgrade redis6-docUpgrade valkey-devel | Jul 11, 2025 | Jul 7, 2025 |
| Debian | — | Upgrade valkeyUpgrade redis | Jul 9, 2025 | Jul 7, 2025 |
| Freebsd | — | Upgrade valkeyUpgrade redis62Upgrade redis74Upgrade redisUpgrade redis72 | Jul 8, 2025 | Jul 7, 2025 |
| Gentoo Linux | — | Upgrade dev-db/redict.Upgrade dev-db/redis. | Nov 25, 2025 | Nov 24, 2025 |
| Oracle_linux | — | Upgrade redis-docUpgrade valkey-develUpgrade valkeyUpgrade redisUpgrade redis-devel | Jul 22, 2025 | Jul 7, 2025 |
| Redhat_linux | — | Upgrade redis-debugsourceUpgrade redis-develUpgrade valkeyUpgrade redisUpgrade valkey-debuginfoUpgrade valkey-develUpgrade redis-docUpgrade redis-debuginfoUpgrade valkey-debugsource | Jul 15, 2025 | Jul 7, 2025 |
| Redislabs Redis | — | Upgrade RedisLabs Redis to version 8.0.3Upgrade RedisLabs Redis to version 7.4.5Upgrade RedisLabs Redis to version 6.2.19Upgrade RedisLabs Redis to version 7.2.10 | Apr 17, 2026 | Jul 7, 2025 |
| Rocky_linux | — | Upgrade redis-debugsourceUpgrade redis-debuginfoUpgrade valkey-develUpgrade valkeyUpgrade redis-develUpgrade valkey-debuginfoUpgrade valkey-debugsourceUpgrade redis | Feb 5, 2026 | Oct 4, 2025 |
| Suse | — | Upgrade redis7Upgrade valkey-develUpgrade valkey-compat-redisUpgrade valkeyUpgrade redis | Dec 5, 2025 | Jul 23, 2025 |
| Ubuntu | — | Upgrade redis-serverUpgrade redis | Mar 19, 2026 | Jul 7, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 9, 2026 | Jul 7, 2025 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub