high CVSS 7 EPSS 6.5% Public exploit available

CVE-2025-32023·Redis vulnerability

Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially leading to remote code execution. The bug likely affects all Redis versions with hyperloglog operations implemented. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing hyperloglog operations. This can be done using ACL to restrict HLL commands.

Severity
high
Software
Redis
Fixed in
8.0.3
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 6.5% — in the top 6% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

From: 8.0.0

Until: 8.0.3

Fixed in: 8.0.3

How to fix this CVE

Update Redis immediately to version 8.0.3 or later to patch a memory corruption vulnerability in hyperloglog operations that could allow authenticated attackers to execute arbitrary code. If immediate patching is not feasible, restrict hyperloglog command execution (PFADD, PFCOUNT, PFMERGE) using Redis ACL rules to prevent exploitation until the upgrade is completed.

sudo dnf update redis

Defensia detects this vulnerability

How to check if you are affected

  1. Run `redis-cli INFO server | grep redis_version` to check the installed Redis version and confirm if it is below 8.0.3, 7.4.5, 7.2.10, or 6.2.19 (depending on your branch)
  2. Check Redis ACL permissions by running `redis-cli ACL LIST` to verify if unauthorized users have access to hyperloglog commands (PFADD, PFCOUNT, PFMERGE)
  3. Search Redis server logs (typically in /var/log/redis/) for patterns like 'hyperloglog', 'PFADD', 'PFCOUNT', or 'PFMERGE' commands executed by non-administrative users, especially with unusual or malformed string arguments
  4. After patching, verify the fix with `redis-cli INFO server | grep redis_version` to confirm the version matches the fixed release

FAQ

What is CVE-2025-32023?

CVE-2025-32023 is a memory corruption vulnerability in Redis hyperloglog operations that permits authenticated users to write beyond allocated memory boundaries, potentially enabling remote code execution through specially crafted string inputs.

Is CVE-2025-32023 being actively exploited?

While not currently listed on the CISA KEV catalog, public exploit code is available (Exploit-DB ID 52477), making this vulnerability a practical threat to unpatched instances with weak access controls.

What versions of Redis are affected by CVE-2025-32023?

Redis versions from 2.8 through 8.0.2, 7.4.4, 7.2.9, and 6.2.18 are vulnerable. Version 8.0.3 and later branch releases (7.4.5, 7.2.10, 6.2.19) include the fix.

How do I check if my server is vulnerable to CVE-2025-32023?

Connect to Redis and run `INFO server` to retrieve the version number. If it is older than 8.0.3, 7.4.5, 7.2.10, or 6.2.19 (depending on your branch), your installation is vulnerable.

Does Defensia detect CVE-2025-32023?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Redis is installed on a monitored server, CVE-2025-32023 will appear in your dashboard with remediation steps.

Related Redis CVEs

CVE-2022-0543CVSS 10It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
CVE-2026-23479CVSS 8.8Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.
CVE-2026-25243CVSS 8.8Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.
CVE-2018-12326CVSS 8.5Buffer overflow in redis-cli of Redis before 4.0.10 and 5.x before 5.0 RC3 allows an attacker to achieve code execution and escalate to higher privileges via a crafted command line. NOTE: It is unclear whether there are any common situations in which redis-cli is used with, for example, a -h (aka hostname) argument from an untrusted source.
CVE-2026-66373CVSS 8.5Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2025-32023. Free for 1 server.

Get started free