{"id":"CVE-2023-28425","aliases":["AZL-25674","BELL-CVE-2023-28425","BIT-keydb-2023-28425","BIT-redis-2023-28425","BIT-valkey-2023-28425","DEBIAN-CVE-2023-28425","EUVD-2023-32121","GHSA-mvmm-4vq6-vw8c","SUSE-SU-2023:2925-1","UBUNTU-CVE-2023-28425","openSUSE-SU-2024:12874-1"],"status":"published","title":"Specially crafted MSETNX command can lead to denial-of-service","description":"Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in Redis version 7.0.10.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.58526,"percentile":0.99111,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-617","CWE-77"],"published":"2023-03-20T19:03:37Z","modified":"2026-10-28T10:32:42Z","fixes":[{"ecosystem":"Azure Linux:2","package":"redis","fixed_in":["6.2.12-1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"keydb","fixed_in":["7.0.10"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"redis","fixed_in":["7.0.10"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"valkey","fixed_in":["7.0.10"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"redis","fixed_in":["5:7.0.10-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"redis","fixed_in":["5:7.0.10-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"redis","fixed_in":["5:7.0.10-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.12-1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"keydb","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.8"},{"fixed":"7.0.10"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"redis","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.8"},{"fixed":"7.0.10"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"valkey","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.8"},{"fixed":"7.0.10"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:7.0.10-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:7.0.10-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:7.0.10-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"redis7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8-150500.3.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"redis7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8-150500.3.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.11-1.1"}]}],"bundled":2}],"products":[{"vendor":"redis","product":"redis"}],"references":[{"url":"https://github.com/redis/redis/security/advisories/GHSA-mvmm-4vq6-vw8c","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/redis/redis/commit/48e0d4788434833b47892fe9f3d91be7687f25c9","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://github.com/redis/redis/releases/tag/7.0.10","tags":["x_refsource_MISC","x_transferred","Release Notes","article","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20230413-0005/","tags":["x_transferred","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28425","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-28425","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28425.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-28425","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232925-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1208790","tags":["report"]},{"url":"https://bugzilla.suse.com/1208793","tags":["report"]},{"url":"https://bugzilla.suse.com/1209528","tags":["report"]},{"url":"https://bugzilla.suse.com/1210548","tags":["report"]},{"url":"https://bugzilla.suse.com/1213193","tags":["report"]},{"url":"https://bugzilla.suse.com/1213249","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-36021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-36824","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-28425","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-28425","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-28425","title":"Specially crafted MSETNX command can lead to denial-of-service","description":"Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in Redis version 7.0.10.","status":"published","published":"2023-03-20T19:03:37.983Z","modified":"2025-02-25T14:52:01.127Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:35:33.138994Z"}],"euvd":[{"id":"EUVD-2023-32121","description":"Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in Redis version 7.0.10.","status":"published","published":"2023-03-20T19:03:37Z","modified":"2025-02-25T14:52:01Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T20:53:24.646946Z"}],"nvd":[{"id":"CVE-2023-28425","description":"Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in Redis version 7.0.10.","status":"published","published":"2023-03-20T20:15:52.787Z","modified":"2026-06-17T05:47:41.42Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-77","CWE-617"],"updated_at":"2026-11-02T14:07:49.031498Z"}],"osv":[{"id":"AZL-25674","title":"CVE-2023-28425 affecting package redis for versions less than 6.2.12-1","description":"Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in Redis version 7.0.10.","status":"published","published":"2023-03-20T20:15:52Z","modified":"2026-04-21T04:23:11.407289Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"BELL-CVE-2023-28425","title":"CVE-2023-28425 does not affect BellSoft software","status":"withdrawn","published":"2023-10-18T13:45:40.136888Z","modified":"2026-01-26T09:45:58.699355Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"CVE-2023-28425","title":"Specially crafted MSETNX command can lead to denial-of-service","description":"Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in Redis version 7.0.10.","status":"published","published":"2023-03-20T19:03:37.983Z","modified":"2026-10-28T10:32:42.577383018Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:44:31.468318Z"},{"id":"DEBIAN-CVE-2023-28425","description":"Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in Redis version 7.0.10.","status":"published","published":"2023-03-20T20:15:52.787Z","modified":"2026-10-26T18:00:10.722941688Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:39.679062Z"},{"id":"UBUNTU-CVE-2023-28425","description":"Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in Redis version 7.0.10.","status":"withdrawn","published":"2023-03-20T20:15:00Z","modified":"2025-07-16T07:45:54.619044Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:20.997471Z"},{"id":"BIT-keydb-2023-28425","title":"Specially crafted MSETNX command can lead to denial-of-service","description":"Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in Redis version 7.0.10.","status":"published","published":"2024-08-22T19:24:32.454Z","modified":"2026-09-08T08:48:07.312016192Z","updated_at":"2026-11-02T15:28:32.162822Z"},{"id":"BIT-redis-2023-28425","title":"Specially crafted MSETNX command can lead to denial-of-service","description":"Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in Redis version 7.0.10.","status":"published","published":"2024-03-06T11:04:24.673Z","modified":"2026-09-08T08:48:19.029736293Z","updated_at":"2026-11-02T15:28:35.111822Z"},{"id":"BIT-valkey-2023-28425","title":"Specially crafted MSETNX command can lead to denial-of-service","description":"Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in Redis version 7.0.10.","status":"published","published":"2024-08-22T19:42:01.85Z","modified":"2025-10-15T02:27:31.376735Z","updated_at":"2026-11-02T15:28:36.104787Z"},{"id":"openSUSE-SU-2024:12874-1","title":"redis-7.0.11-1.1 on GA media","description":"These are all security issues fixed in the redis-7.0.11-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:19:41.400596Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"SUSE-SU-2023:2925-1","title":"Security update for redis7","description":"This update for redis7 fixes the following issues:\n\n  - CVE-2022-24834: Fixed heap overflow in the cjson and cmsgpack libraries (bsc#1213193).\n  - CVE-2023-28856: Fixed HINCRBYFLOAT invalid key crash (bsc#1210548).\n  - CVE-2022-36021: Fixed integer overflow via Specially crafted SRANDMEMBER, ZRANDMEMBER, and HRANDFIELD (bsc#1208790).\n  - CVE-2023-25155: Fixed Integer Overflow in RAND commands (bsc#1208793).\n  - CVE-2023-28425: Fixed denial-of-service via Specially crafted MSETNX command (bsc#1209528).\n  - CVE-2023-36824: Fixed heap overflow in COMMAND GETKEYS and ACL evaluation (bsc#1213249).\n","status":"published","published":"2023-07-20T19:34:11Z","modified":"2026-02-04T03:15:19.67299Z","updated_at":"2026-11-02T15:53:53.019382Z"}]}}