CVE-2025-62507

Name
CVE-2025-62507
Description
Redis is an open source, in-memory database that persists on disk. In versions 8.2.0 and above, a user can run the XACKDEL command with multiple ID's and trigger a stack buffer overflow, which may potentially lead to remote code execution. This issue is fixed in version 8.2.3. To workaround this issue without patching the redis-server executable is to prevent users from executing XACKDEL operation. This can be done using ACL to restrict XACKDEL command.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
CONFIRM https://github.com/redis/redis/security/advisories/GHSA-jhjx-x4cf-4vm8
MISC https://github.com/redis/redis/commit/5f83972188f6e5b1d6f1940218c650a9cbdf7741
MISC https://github.com/redis/redis/releases/tag/8.2.3

Match rules

CPE URI Source package Min version Max version
redis >= 8.2.0 < 8.2.3

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
redis edge-community 8.2.0-r0 fossdd <fossdd@pwned.life> possibly vulnerable
redis edge-community 8.2.0-r1 Achill Gilgenast <achill@achill.org> possibly vulnerable
redis edge-community 8.2.1-r0 Achill Gilgenast <achill@achill.org> possibly vulnerable
redis edge-community 8.2.2-r0 Achill Gilgenast <achill@achill.org> possibly vulnerable
redis edge-community 8.2.3-r0 Achill Gilgenast <achill@achill.org> fixed