{"id":"CVE-2025-27151","aliases":["ALPINE-CVE-2025-27151","ALSA-2025:11401","ALSA-2025:12008","AZL-63750","BELL-CVE-2025-27151","BIT-keydb-2025-27151","BIT-redis-2025-27151","BIT-valkey-2025-27151","DEBIAN-CVE-2025-27151","DSA-5969-1","EUVD-2025-16375","GHSA-5453-q98w-cmvm","MGASA-2025-0211","OESA-2025-1630","RHSA-2025:11401","RHSA-2025:12008","RLSA-2025:11401","RLSA-2025:12008","SUSE-SU-2025:01942-1","SUSE-SU-2025:02190-1","SUSE-SU-2025:02231-1","SUSE-SU-2025:02679-1","SUSE-SU-2025:02681-1","UBUNTU-CVE-2025-27151","openSUSE-SU-2025:15293-1","openSUSE-SU-2025:15306-1"],"status":"published","title":"redis-check-aof may lead to stack overflow and potential RCE","description":"Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a stack-based buffer overflow exists in redis-check-aof due to the use of memcpy with strlen(filepath) when copying a user-supplied file path into a fixed-size stack buffer. This allows an attacker to overflow the stack and potentially achieve code execution. This issue has been patched in version 8.0.2.","severity":{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01058,"percentile":0.64745,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-121","CWE-20"],"published":"2025-05-29T09:07:34Z","modified":"2026-11-03T06:33:00Z","fixes":[{"ecosystem":"Alpine:v3.20","package":"redict","fixed_in":["7.3.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"redict","fixed_in":["7.3.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"redict","fixed_in":["7.3.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"redict","fixed_in":["7.3.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"redict","fixed_in":["7.3.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"redis","fixed_in":["7.0.15-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"redis","fixed_in":["7.2.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"redis","fixed_in":["7.2.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"redis","fixed_in":["7.2.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"redis","fixed_in":["8.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"redis","fixed_in":["8.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"redis","fixed_in":["8.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"valkey","fixed_in":["7.2.9-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"valkey","fixed_in":["7.2.9-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"valkey","fixed_in":["8.1.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"valkey","fixed_in":["8.1.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"valkey","fixed_in":["8.1.1-r1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"valkey","fixed_in":["8.0.3-3"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"redis","fixed_in":["7.0.15-r4"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"redis","fixed_in":["8.0.2-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"redis","fixed_in":["7.2.9","7.4.4","8.0.2"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"valkey","fixed_in":["7.2.10","8.0.5","8.1.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"redict","fixed_in":["7.3.5+ds-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"redis","fixed_in":["5:7.0.15-1~deb12u5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"redis","fixed_in":["5:8.0.2-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"redis","fixed_in":["5:8.0.2-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"valkey","fixed_in":["8.1.1+dfsg1-1.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"valkey","fixed_in":["8.1.1+dfsg1-1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"redis","fixed_in":["7.2.4-150600.3.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"redis","fixed_in":["7.2.4-150600.3.12.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"redict","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"redict","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"redict","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"redict","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"redict","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.15-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.2.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.2.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.2.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"8.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"8.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"8.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.9-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.9-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.1-r1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.4-1.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"valkey-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.4-1.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.10-1.module_el9.6.0+173+efaf9205"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"redis-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.10-1.module_el9.6.0+173+efaf9205"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"redis-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.10-1.module_el9.6.0+173+efaf9205"}]}],"bundled":3},{"source":"osv","ecosystem":"Azure Linux:3","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.3-3"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.9-r0"},{"fixed":"7.0.15-r4"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.9-r0"},{"fixed":"8.0.2-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"keydb","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"redis","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.2.9"},{"introduced":"7.3.0"},{"fixed":"7.4.4"},{"introduced":"8.0.0"},{"fixed":"8.0.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"valkey","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.2.10"},{"introduced":"7.3.0"},{"fixed":"8.0.5"},{"introduced":"8.1.0"},{"fixed":"8.1.2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"redict","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.5+ds-1"}]}],"versions":["7.3.0+ds-1","7.3.0+ds-2","7.3.0+ds-3","7.3.0+ds-3~bpo12+1","7.3.1+ds-1","7.3.2+ds-1","7.3.2+ds-1~bpo12+1","7.3.5+ds-1~bpo12+1"]},{"source":"osv","ecosystem":"Debian:12","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:7.0.15-1~deb12u5"}]}],"versions":["5:7.0.11-1","5:7.0.11-1+deb12u1","5:7.0.12-1","5:7.0.12-2","5:7.0.13-1","5:7.0.13-2","5:7.0.14-1","5:7.0.14-2","5:7.0.15-1~deb12u1","5:7.0.15-1~deb12u2","5:7.0.15-1~deb12u3","5:7.0.15-1~deb12u4"]},{"source":"osv","ecosystem":"Debian:13","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:8.0.2-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:8.0.2-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.1+dfsg1-1.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.1+dfsg1-1.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:7.0.15-1~deb12u5"}]}],"versions":["5:7.0.11-1","5:7.0.11-1+deb12u1","5:7.0.12-1","5:7.0.12-2","5:7.0.13-1","5:7.0.13-2","5:7.0.14-1","5:7.0.14-2","5:7.0.15-1~deb12u1","5:7.0.15-1~deb12u2","5:7.0.15-1~deb12u3","5:7.0.15-1~deb12u4"],"bundled":3},{"source":"osv","ecosystem":"Mageia:9","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.10-1.mga9"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.9-2.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.9-2.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.9-2.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.9-2.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.9-2.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.4-1.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"valkey-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.4-1.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"valkey-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.4-1.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"valkey-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.4-1.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.10-1.module+el9.6.0+23332+115a3b01"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.10-1.module+el9.6.0+23332+115a3b01"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.10-1.module+el9.6.0+23332+115a3b01"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.10-1.module+el9.6.0+23332+115a3b01"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.10-1.module+el9.6.0+23332+115a3b01"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:10","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.4-1.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.10-1.module+el9.6.0+32323+e27e860a"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.2-150700.3.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.4-150600.3.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.4-150600.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.2-150600.13.11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.2-150600.13.11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"redis7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8-150600.8.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"redis7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8-150600.8.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"redis7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8-150500.3.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"redis7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8-150500.3.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"redis7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8-150500.3.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"redis7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8-150500.3.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5:7.0.12-1","5:7.0.14-1","5:7.0.14-2","5:7.0.15-1","5:7.0.15-1build1","5:7.0.15-1build2","5:7.0.15-1ubuntu0.24.04.1","5:7.0.15-1ubuntu0.24.04.2","5:7.0.15-1ubuntu0.24.04.3","5:7.0.15-1ubuntu0.24.04.4","5:7.0.15-1ubuntu0.24.04.5"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.2-1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.2-1.1"}]}],"bundled":2}],"products":[{"vendor":"redis","product":"redis"}],"references":[{"url":"https://github.com/redis/redis/security/advisories/GHSA-5453-q98w-cmvm","tags":["x_refsource_CONFIRM","Third Party Advisory","advisory","article","report"]},{"url":"https://github.com/redis/redis/commit/643b5db235cb82508e72f11c7b4bbfc7dc39be56","tags":["x_refsource_MISC","Patch","fix","article","report"]},{"url":"https://github.com/redis/redis/releases/tag/8.0.2","tags":["x_refsource_MISC","Release Notes","article","web","report"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-27151","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:11401","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-27151","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-32023","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-48367","tags":["report"]},{"url":"https://bugzilla.redhat.com/2369153","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2025-11401.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:12008","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-12008.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27151","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-27151","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27151.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-27151","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0211.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34452","tags":["report"]},{"url":"https://github.com/redis/redis/releases/tag/7.2.10","tags":["web","article"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1630","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49112","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2369153","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2376857","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2376858","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11401.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-27151","tags":["advisory","report"]},{"url":"https://github.com/valkey-io/valkey/releases","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-32023","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32023","tags":["advisory"]},{"url":"https://github.com/redis/redis/commit/50188747cbfe43528d2719399a2a3c9599169445","tags":["article"]},{"url":"https://github.com/redis/redis/releases/tag/6.2.19","tags":["article"]},{"url":"https://github.com/redis/redis/releases/tag/7.4.5","tags":["article"]},{"url":"https://github.com/redis/redis/releases/tag/8.0.3","tags":["article"]},{"url":"https://github.com/redis/redis/security/advisories/GHSA-rp2m-q4j6-gr43","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-48367","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48367","tags":["advisory"]},{"url":"https://github.com/redis/redis/commit/bde62951accfc4bb0a516276fd0b4b307e140ce2","tags":["article"]},{"url":"https://github.com/redis/redis/security/advisories/GHSA-4q32-c38c-pwgq","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_12008.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:11401","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:12008","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501942-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1241708","tags":["report"]},{"url":"https://bugzilla.suse.com/1243061","tags":["report"]},{"url":"https://bugzilla.suse.com/1243804","tags":["report"]},{"url":"https://bugzilla.suse.com/1243913","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49112","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502190-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502231-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502679-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1246058","tags":["report"]},{"url":"https://bugzilla.suse.com/1246059","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48367","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502681-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-27151","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31228","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-51741","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-27151","title":"redis-check-aof may lead to stack overflow and potential RCE","description":"Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a stack-based buffer overflow exists in redis-check-aof due to the use of memcpy with strlen(filepath) when copying a user-supplied file path into a fixed-size stack buffer. This allows an attacker to overflow the stack and potentially achieve code execution. This issue has been patched in version 8.0.2.","status":"published","published":"2025-05-29T09:07:34.779Z","modified":"2025-05-29T13:43:09.725Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-20","CWE-121"],"updated_at":"2026-11-02T14:32:42.751171Z"}],"euvd":[{"id":"EUVD-2025-16375","description":"Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a stack-based buffer overflow exists in redis-check-aof due to the use of memcpy with strlen(filepath) when copying a user-supplied file path into a fixed-size stack buffer. This allows an attacker to overflow the stack and potentially achieve code execution. This issue has been patched in version 8.0.2.","status":"published","published":"2025-05-29T09:07:34Z","modified":"2025-05-29T13:43:09Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T20:32:35.823426Z"}],"nvd":[{"id":"CVE-2025-27151","description":"Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a stack-based buffer overflow exists in redis-check-aof due to the use of memcpy with strlen(filepath) when copying a user-supplied file path into a fixed-size stack buffer. This allows an attacker to overflow the stack and potentially achieve code execution. This issue has been patched in version 8.0.2.","status":"published","published":"2025-05-29T09:15:25.98Z","modified":"2026-06-17T09:03:06.45Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-20","CWE-121"],"updated_at":"2026-11-02T14:11:10.143444Z"}],"osv":[{"id":"ALPINE-CVE-2025-27151","description":"Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a stack-based buffer overflow exists in redis-check-aof due to the use of memcpy with strlen(filepath) when copying a user-supplied file path into a fixed-size stack buffer. This allows an attacker to overflow the stack and potentially achieve code execution. This issue has been patched in version 8.0.2.","status":"published","published":"2025-05-29T09:15:25.98Z","modified":"2026-11-03T06:33:00.357223307Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:16:09.603409Z"},{"id":"BELL-CVE-2025-27151","status":"published","published":"2025-05-29T17:20:14.629419Z","modified":"2026-08-30T11:32:54.85246Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:21.741325Z"},{"id":"CVE-2025-27151","title":"redis-check-aof may lead to stack overflow and potential RCE","description":"Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a stack-based buffer overflow exists in redis-check-aof due to the use of memcpy with strlen(filepath) when copying a user-supplied file path into a fixed-size stack buffer. This allows an attacker to overflow the stack and potentially achieve code execution. This issue has been patched in version 8.0.2.","status":"published","published":"2025-05-29T09:07:34.779Z","modified":"2026-10-28T10:51:34.923280142Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-121","CWE-20"],"updated_at":"2026-11-02T15:44:47.386092Z"},{"id":"DEBIAN-CVE-2025-27151","description":"Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a stack-based buffer overflow exists in redis-check-aof due to the use of memcpy with strlen(filepath) when copying a user-supplied file path into a fixed-size stack buffer. This allows an attacker to overflow the stack and potentially achieve code execution. This issue has been patched in version 8.0.2.","status":"published","published":"2025-05-29T09:15:25.98Z","modified":"2026-09-01T20:05:45.602458617Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:45.870237Z"},{"id":"OESA-2025-1630","title":"redis security update","description":"Redis is an advanced key-value store. It is often referred to as a dattructure server since keys can contain strings, hashes ,lists, sets anorted sets.\r\n\r\nSecurity Fix(es):\n\nRedis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a stack-based buffer overflow exists in redis-check-aof due to the use of memcpy with strlen(filepath) when copying a user-supplied file path into a fixed-size stack buffer. This allows an attacker to overflow the stack and potentially achieve code execution. This issue has been patched in version 8.0.2.(CVE-2025-27151)\n\nsetDeferredReply in networking.c in Valkey through 8.1.1 has an integer underflow for prev-\u0026gt;size - prev-\u0026gt;used.(CVE-2025-49112)","status":"published","published":"2025-06-13T11:08:43Z","modified":"2026-08-18T01:18:51.700414572Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"RHSA-2025:11401","title":"Red Hat Security Advisory: valkey security update","status":"published","published":"2025-07-21T10:02:03Z","modified":"2026-08-08T10:06:39Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:12008","title":"Red Hat Security Advisory: redis:7 security update","status":"published","published":"2025-07-29T10:07:34Z","modified":"2026-08-08T10:06:41Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RLSA-2025:11401","title":"Important: valkey security update","description":"Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets.  You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set.  In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log.  Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth.  Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache.  You can use Valkey from most programming languages also.\n\nSecurity Fix(es):\n\n* redis: Redis Stack Buffer Overflow (CVE-2025-27151)\n\n* redis: Redis Unauthenticated Denial of Service (CVE-2025-48367)\n\n* redis: Redis Hyperloglog Out-of-Bounds Write Vulnerability (CVE-2025-32023)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-03T19:56:45.27031Z","modified":"2025-10-08T17:12:46.085355Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"RLSA-2025:12008","title":"Important: redis:7 security update","description":"Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.\n\nSecurity Fix(es):\n\n* redis: Redis Stack Buffer Overflow (CVE-2025-27151)\n\n* redis: Redis Unauthenticated Denial of Service (CVE-2025-48367)\n\n* redis: Redis Hyperloglog Out-of-Bounds Write Vulnerability (CVE-2025-32023)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-04T00:11:30.91642Z","modified":"2025-10-07T17:40:08.224669Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"UBUNTU-CVE-2025-27151","description":"Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a stack-based buffer overflow exists in redis-check-aof due to the use of memcpy with strlen(filepath) when copying a user-supplied file path into a fixed-size stack buffer. This allows an attacker to overflow the stack and potentially achieve code execution. This issue has been patched in version 8.0.2.","status":"published","published":"2025-05-29T09:15:00Z","modified":"2026-10-06T23:30:50.23019308Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:55:26.330196Z"},{"id":"ALSA-2025:11401","title":"Important: valkey security update","description":"Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also.  \n\nSecurity Fix(es):  \n\n  * redis: Redis Stack Buffer Overflow (CVE-2025-27151)\n  * redis: Redis Unauthenticated Denial of Service (CVE-2025-48367)\n  * redis: Redis Hyperloglog Out-of-Bounds Write Vulnerability (CVE-2025-32023)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-07-21T00:00:00Z","modified":"2026-10-29T11:58:15.525142Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2025:12008","title":"Important: redis:7 security update","description":"Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.  \n\nSecurity Fix(es):  \n\n  * redis: Redis Stack Buffer Overflow (CVE-2025-27151)\n  * redis: Redis Unauthenticated Denial of Service (CVE-2025-48367)\n  * redis: Redis Hyperloglog Out-of-Bounds Write Vulnerability (CVE-2025-32023)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-07-28T00:00:00Z","modified":"2026-10-29T11:32:27.590026304Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"AZL-63750","title":"CVE-2025-27151 affecting package valkey for versions less than 8.0.3-3","description":"Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a stack-based buffer overflow exists in redis-check-aof due to the use of memcpy with strlen(filepath) when copying a user-supplied file path into a fixed-size stack buffer. This allows an attacker to overflow the stack and potentially achieve code execution. This issue has been patched in version 8.0.2.","status":"published","published":"2025-05-29T09:15:25Z","modified":"2026-04-21T04:50:18.850516Z","updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"BIT-keydb-2025-27151","title":"redis-check-aof may lead to stack overflow and potential RCE","description":"Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a stack-based buffer overflow exists in redis-check-aof due to the use of memcpy with strlen(filepath) when copying a user-supplied file path into a fixed-size stack buffer. This allows an attacker to overflow the stack and potentially achieve code execution. This issue has been patched in version 8.0.2.","status":"published","published":"2025-05-31T05:45:47.374Z","modified":"2026-09-08T08:48:07.397021071Z","updated_at":"2026-11-02T15:28:32.162822Z"},{"id":"BIT-redis-2025-27151","title":"redis-check-aof may lead to stack overflow and potential RCE","description":"Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a stack-based buffer overflow exists in redis-check-aof due to the use of memcpy with strlen(filepath) when copying a user-supplied file path into a fixed-size stack buffer. This allows an attacker to overflow the stack and potentially achieve code execution. This issue has been patched in version 8.0.2.","status":"published","published":"2025-05-31T05:59:53.747Z","modified":"2026-09-08T08:48:18.926456095Z","updated_at":"2026-11-02T15:28:35.111822Z"},{"id":"BIT-valkey-2025-27151","title":"redis-check-aof may lead to stack overflow and potential RCE","description":"Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a stack-based buffer overflow exists in redis-check-aof due to the use of memcpy with strlen(filepath) when copying a user-supplied file path into a fixed-size stack buffer. This allows an attacker to overflow the stack and potentially achieve code execution. This issue has been patched in version 8.0.2.","status":"published","published":"2025-05-31T06:02:22.962Z","modified":"2026-09-08T08:48:20.997305061Z","updated_at":"2026-11-02T15:28:36.104787Z"},{"id":"DSA-5969-1","title":"redis - security update","status":"published","published":"2025-07-31T00:00:00Z","modified":"2026-03-09T02:10:42.589348Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"MGASA-2025-0211","title":"Updated redis packages fix security vulnerabilities","description":"Updated redis packages to a more recent version to fix security\nvulnerabilities:\nSome vulnerabilities have been discovered and fixed.\nPlease note this update is from 7.0 to 7.2 which brings some potentially\nbreaking changes. In most cases this update could be installed without\nproblems.\nPotentially Breaking / Behavior Changes:\n* Client side tracking for scripts now tracks the keys that are read by\n  the script instead of the keys that are declared by the caller of EVAL /\n  FCALL (#11770)\n* Freeze time sampling during command execution and in scripts (#10300)\n* When a blocked command is being unblocked, checks like ACL, OOM, etc\n  are re-evaluated (#11012)\n* Unify ACL failure error message text and error codes (#11160)\n* Blocked stream command that's released when key no longer exists\n  carries a different error code (#11012)\n* Command stats are updated for blocked commands only when / if the\n  command actually executes (#11012)\n* The way ACL users are stored internally no longer removes redundant\n  command and category rules, which may alter the way those rules are\n  displayed as part of `ACL SAVE`, `ACL GETUSER` and `ACL LIST` (#11224)\n* Client connections created for TLS-based replication use SNI if\n  possible (#11458)\n* Stream consumers: Re-purpose seen-time, add active-time (#11099)\n* XREADGROUP and X[AUTO]CLAIM create the consumer regardless of whether\n  it was able to perform some reading/claiming (#11099)\n* ACL default newly created user set sanitize-payload flag in ACL\n  LIST/GETUSER #11279\n* Fix HELLO command not to affect the client state unless successful\n  (#11659)\n* Normalize `NAN` in replies to a single nan type, like we do with `inf`\n  (#11597)\n* Cluster SHARD IDs are no longer visible in the cluster nodes output,\n  introduced in 7.2-RC1. (#10536, #12166)\n* When calling PUBLISH with a RESP3 client that's also subscribed to the\n  same channel, the order is changed and the reply is sent before the\n  published message (#12326)\n","status":"published","published":"2025-07-19T17:55:11Z","modified":"2026-04-16T04:43:48.632653865Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15293-1","title":"redis-8.0.2-1.1 on GA media","description":"These are all security issues fixed in the redis-8.0.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:36.205134Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15306-1","title":"valkey-8.1.2-1.1 on GA media","description":"These are all security issues fixed in the valkey-8.1.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:37.655436Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"SUSE-SU-2025:01942-1","title":"Security update for valkey","description":"This update for valkey fixes the following issues:\n\n- CVE-2025-27151: Absence of filename size check may cause a stack\n  overflow (bsc#1243804)\n- CVE-2025-49112: setDeferredReply integer underflow (bsc#1243913)\n- CVE-2025-21605: Output buffer denial of service (bsc#1241708)\n","status":"published","published":"2025-06-13T08:33:49Z","modified":"2026-03-23T04:48:30.050805Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02190-1","title":"Security update for redis","description":"This update for redis fixes the following issues:\n\n- CVE-2025-27151: Absence of filename size check may cause a stack\n  overflow (bsc#1243804)\n","status":"published","published":"2025-07-01T15:06:36Z","modified":"2026-02-04T03:05:07.165971Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02231-1","title":"Security update for valkey","description":"This update for valkey fixes the following issues:\n\n- CVE-2025-27151: Absence of filename size check may cause a stack overflow (bsc#1243804).\n- CVE-2025-49112: setDeferredReply integer underflow (bsc#1243913).\n","status":"published","published":"2025-07-07T07:50:14Z","modified":"2026-02-04T04:02:31.041116Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02679-1","title":"Security update for redis","description":"This update for redis fixes the following issues:\n\n- CVE-2025-27151: Fixed absence of filename size check may cause a stack overflow. (bsc#1243804)\n- CVE-2025-32023: Fixed out-of-bounds write when working with HyperLogLog commands can lead to remote code execution. (bsc#1246059)\n- CVE-2025-48367: Fixed unauthenticated connection causing repeated IP protocol erros can lead to client starvation and DoS. (bsc#1246058)\n","status":"published","published":"2025-08-04T15:03:05Z","modified":"2026-03-23T04:46:45.457047Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:02681-1","title":"Security update for redis","description":"This update for redis fixes the following issues:\n\n- CVE-2025-27151: Fixed absence of filename size check may cause a stack overflow. (bsc#1243804)\n- CVE-2025-32023: Fixed out-of-bounds write when working with HyperLogLog commands can lead to remote code execution. (bsc#1246059)\n- CVE-2025-48367: Fixed unauthenticated connection causing repeated IP protocol erros can lead to client starvation and DoS. (bsc#1246058)\n","status":"published","published":"2025-08-04T15:04:37Z","modified":"2026-03-23T04:46:45.626898Z","updated_at":"2026-11-02T15:53:57.111474Z"}]}}