CVE-2025-62507

Redis is an open source, in-memory database that persists on disk. In versions 8.2.0 and above, a user can run the XACKDEL command with multiple ID's and trigger a stack buffer overflow, which may potentially lead to remote code execution. This issue is fixed in version 8.2.3. To workaround this issue without patching the redis-server executable is to prevent users from executing XACKDEL operation. This can be done using ACL to restrict XACKDEL command.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/redis/redis/commit/5f83972188f6e5b1d6f1940218c650a9cbdf7741	Patch
https://github.com/redis/redis/releases/tag/8.2.3	Release Notes
https://github.com/redis/redis/security/advisories/GHSA-jhjx-x4cf-4vm8	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*

History

19 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Redis es una base de datos de código abierto, en memoria que persiste en disco. En las versiones 8.2.0 y superiores, un usuario puede ejecutar el comando XACKDEL con múltiples ID y desencadenar un desbordamiento de búfer de pila, lo que podría conducir potencialmente a la ejecución remota de código. Este problema está solucionado en la versión 8.2.3. La solución alternativa para este problema sin parchear el ejecutable del servidor Redis consiste en evitar que los usuarios ejecuten la operación XACKDEL. Esto se puede hacer usando ACL para restringir el comando XACKDEL.

Information

Published : 2025-11-04 22:16

Updated : 2026-10-19 13:10

NVD link : CVE-2025-62507

Mitre link : CVE-2025-62507

CVE.ORG link : CVE-2025-62507

JSON object : View

Products Affected

redis

redis

CWE

CWE-20

Improper Input Validation

CWE-121

Stack-based Buffer Overflow

CWE-787

Out-of-bounds Write

{"id": "CVE-2025-62507", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62507", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-11-06T04:55:35.365493Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "redis", "product": "redis", "versions": [{"status": "affected", "version": ">= 8.2.0, < 8.2.3"}]}]}], "published": "2025-11-04T22:16:38.330", "references": [{"url": "https://github.com/redis/redis/commit/5f83972188f6e5b1d6f1940218c650a9cbdf7741", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/redis/redis/releases/tag/8.2.3", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/redis/redis/security/advisories/GHSA-jhjx-x4cf-4vm8", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-121"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "Redis is an open source, in-memory database that persists on disk. In versions 8.2.0 and above, a user can run the XACKDEL command with multiple ID's and trigger a stack buffer overflow, which may potentially lead to remote code execution. This issue is fixed in version 8.2.3. To workaround this issue without patching the redis-server executable is to prevent users from executing XACKDEL operation. This can be done using ACL to restrict XACKDEL command."}, {"lang": "es", "value": "Redis es una base de datos de c\u00f3digo abierto, en memoria que persiste en disco. En las versiones 8.2.0 y superiores, un usuario puede ejecutar el comando XACKDEL con m\u00faltiples ID y desencadenar un desbordamiento de b\u00fafer de pila, lo que podr\u00eda conducir potencialmente a la ejecuci\u00f3n remota de c\u00f3digo. Este problema est\u00e1 solucionado en la versi\u00f3n 8.2.3. La soluci\u00f3n alternativa para este problema sin parchear el ejecutable del servidor Redis consiste en evitar que los usuarios ejecuten la operaci\u00f3n XACKDEL. Esto se puede hacer usando ACL para restringir el comando XACKDEL."}], "lastModified": "2026-10-19T13:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9682570D-1383-47DD-808E-7D75B67BDE73", "versionEndExcluding": "8.2.3", "versionStartIncluding": "8.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}