{"id":"CVE-2025-62507","aliases":["ALPINE-CVE-2025-62507","BELL-CVE-2025-62507","BIT-keydb-2025-62507","BIT-redis-2025-62507","EUVD-2025-37903","GHSA-jhjx-x4cf-4vm8","UBUNTU-CVE-2025-62507","openSUSE-SU-2025:15698-1","openSUSE-SU-2025:20121-1"],"status":"published","title":"Redis: Bug in XACKDEL may lead to stack overflow and potential RCE","description":"Redis is an open source, in-memory database that persists on disk. In versions 8.2.0 and above, a user can run the XACKDEL command with multiple ID's and trigger a stack buffer overflow, which may potentially lead to remote code execution. This issue is fixed in version 8.2.3. To workaround this issue without patching the redis-server executable is to prevent users from executing XACKDEL operation. This can be done using ACL to restrict XACKDEL command.","severity":{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.07471,"percentile":0.94545,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-121","CWE-20","CWE-787"],"published":"2025-11-02T00:00:00Z","modified":"2026-11-03T06:32:52Z","exploits":[{"source":"pocgithub","id":"GartonChan/redis-cve-2025-62507","title":"GartonChan/redis-cve-2025-62507","date":"2026-06-02","url":"https://github.com/GartonChan/redis-cve-2025-62507"}],"fixes":[{"ecosystem":"Alpine:v3.23","package":"redis","fixed_in":["8.2.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"redis","fixed_in":["8.2.3-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"redis","fixed_in":["8.2.3-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"keydb","fixed_in":["8.2.3"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"redis","fixed_in":["8.2.3"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"redis","fixed_in":["8.2.3-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.2.0"},{"fixed":"8.2.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.2.0"},{"fixed":"8.2.3-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.9-r0"},{"fixed":"8.2.3-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"keydb","ranges":[{"type":"SEMVER","events":[{"introduced":"8.2.0"},{"fixed":"8.2.3"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"redis","ranges":[{"type":"SEMVER","events":[{"introduced":"8.2.0"},{"fixed":"8.2.3"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.3-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.3-bp160.1.1"}]}],"bundled":5}],"products":[{"vendor":"redis","product":"redis"}],"references":[{"url":"https://github.com/redis/redis/security/advisories/GHSA-jhjx-x4cf-4vm8","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","report"]},{"url":"https://github.com/redis/redis/commit/5f83972188f6e5b1d6f1940218c650a9cbdf7741","tags":["x_refsource_MISC","Patch","fix","report"]},{"url":"https://github.com/redis/redis/releases/tag/8.2.3","tags":["x_refsource_MISC","Release Notes","article","web","report"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-62507","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-62507","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62507","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62507.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-62507","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-62507","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62507","tags":["web"]},{"url":"https://bugzilla.suse.com/1250995","tags":["report"]},{"url":"https://bugzilla.suse.com/1252996","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49844","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-62507","title":"Redis: Bug in XACKDEL may lead to stack overflow and potential RCE","description":"Redis is an open source, in-memory database that persists on disk. In versions 8.2.0 and above, a user can run the XACKDEL command with multiple ID's and trigger a stack buffer overflow, which may potentially lead to remote code execution. This issue is fixed in version 8.2.3. To workaround this issue without patching the redis-server executable is to prevent users from executing XACKDEL operation. This can be done using ACL to restrict XACKDEL command.","status":"published","published":"2025-11-04T21:24:44.802Z","modified":"2026-02-26T17:47:18.954Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-20","CWE-121"],"updated_at":"2026-11-02T14:32:54.87586Z"}],"euvd":[{"id":"EUVD-2025-37903","description":"Redis is an open source, in-memory database that persists on disk. In versions 8.2.0 and above, a user can run the XACKDEL command with multiple ID's and trigger a stack buffer overflow, which may potentially lead to remote code execution. This issue is fixed in version 8.2.3. To workaround this issue without patching the redis-server executable is to prevent users from executing XACKDEL operation. This can be done using ACL to restrict XACKDEL command.","status":"published","published":"2025-11-04T21:24:44Z","modified":"2026-02-26T17:47:18Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T19:48:23.405029Z"}],"nvd":[{"id":"CVE-2025-62507","description":"Redis is an open source, in-memory database that persists on disk. In versions 8.2.0 and above, a user can run the XACKDEL command with multiple ID's and trigger a stack buffer overflow, which may potentially lead to remote code execution. This issue is fixed in version 8.2.3. To workaround this issue without patching the redis-server executable is to prevent users from executing XACKDEL operation. This can be done using ACL to restrict XACKDEL command.","status":"published","published":"2025-11-04T22:16:38.33Z","modified":"2026-10-19T13:10:00.11Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-20","CWE-121","CWE-787"],"updated_at":"2026-11-02T14:11:42.142547Z"}],"osv":[{"id":"ALPINE-CVE-2025-62507","description":"Redis is an open source, in-memory database that persists on disk. In versions 8.2.0 and above, a user can run the XACKDEL command with multiple ID's and trigger a stack buffer overflow, which may potentially lead to remote code execution. This issue is fixed in version 8.2.3. To workaround this issue without patching the redis-server executable is to prevent users from executing XACKDEL operation. This can be done using ACL to restrict XACKDEL command.","status":"published","published":"2025-11-04T22:16:38.33Z","modified":"2026-11-03T06:32:52.091274664Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:26.770911Z"},{"id":"BELL-CVE-2025-62507","status":"published","published":"2025-11-07T06:05:30.584479Z","modified":"2026-01-26T09:40:36.799049Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:22.495824Z"},{"id":"CVE-2025-62507","title":"Redis: Bug in XACKDEL may lead to stack overflow and potential RCE","description":"Redis is an open source, in-memory database that persists on disk. In versions 8.2.0 and above, a user can run the XACKDEL command with multiple ID's and trigger a stack buffer overflow, which may potentially lead to remote code execution. This issue is fixed in version 8.2.3. To workaround this issue without patching the redis-server executable is to prevent users from executing XACKDEL operation. This can be done using ACL to restrict XACKDEL command.","status":"published","published":"2025-11-04T21:24:44.802Z","modified":"2026-10-28T10:45:43.713347236Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-121","CWE-20"],"updated_at":"2026-11-02T15:44:51.851511Z"},{"id":"UBUNTU-CVE-2025-62507","description":"Redis is an open source, in-memory database that persists on disk. In versions 8.2.0 and above, a user can run the XACKDEL command with multiple ID's and trigger a stack buffer overflow, which may potentially lead to remote code execution. This issue is fixed in version 8.2.3. To workaround this issue without patching the redis-server executable is to prevent users from executing XACKDEL operation. This can be done using ACL to restrict XACKDEL command.","status":"withdrawn","published":"2025-11-04T22:16:00Z","modified":"2025-12-17T20:46:22.628628Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:50.817402Z"},{"id":"BIT-keydb-2025-62507","title":"Redis: Bug in XACKDEL may lead to stack overflow and potential RCE","description":"Redis is an open source, in-memory database that persists on disk. In versions 8.2.0 and above, a user can run the XACKDEL command with multiple ID's and trigger a stack buffer overflow, which may potentially lead to remote code execution. This issue is fixed in version 8.2.3. To workaround this issue without patching the redis-server executable is to prevent users from executing XACKDEL operation. This can be done using ACL to restrict XACKDEL command.","status":"published","published":"2025-11-07T08:40:53.783Z","modified":"2026-09-08T08:48:07.615348188Z","updated_at":"2026-11-02T15:28:32.162822Z"},{"id":"BIT-redis-2025-62507","title":"Redis: Bug in XACKDEL may lead to stack overflow and potential RCE","description":"Redis is an open source, in-memory database that persists on disk. In versions 8.2.0 and above, a user can run the XACKDEL command with multiple ID's and trigger a stack buffer overflow, which may potentially lead to remote code execution. This issue is fixed in version 8.2.3. To workaround this issue without patching the redis-server executable is to prevent users from executing XACKDEL operation. This can be done using ACL to restrict XACKDEL command.","status":"published","published":"2025-11-07T08:49:33.083Z","modified":"2026-09-08T08:48:18.930876017Z","updated_at":"2026-11-02T15:28:35.111822Z"},{"id":"openSUSE-SU-2025:15698-1","title":"redis-8.2.3-1.1 on GA media","description":"These are all security issues fixed in the redis-8.2.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-11-02T00:00:00Z","modified":"2026-03-23T04:54:06.51652Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:20121-1","title":"Security update for redis","description":"This update for redis fixes the following issues:\n\n- Updated to 8.2.3 (boo#1252996 CVE-2025-62507)\n  * https://github.com/redis/redis/releases/tag/8.2.3\n  - Security fixes\n    - (CVE-2025-62507) Bug in `XACKDEL` may lead to stack overflow\n      and potential RCE\n  - Bug fixes\n    - `HGETEX`: A missing `numfields` argument when `FIELDS` is\n      used can lead to Redis crash\n    - An overflow in `HyperLogLog` with 2GB+ entries may result in\n      a Redis crash\n    - Cuckoo filter - Division by zero in Cuckoo filter insertion\n    - Cuckoo filter - Counter overflow\n    - Bloom filter - Arbitrary memory read/write with invalid\n      filter\n    - Bloom filter - Out-of-bounds access with empty chain\n    - Top-k - Out-of-bounds access\n    - Bloom filter - Restore invalid filter [We thank AWS security\n      for responsibly disclosing the security bug]\n\n- Updated to 8.2.2 (boo#1250995)\n  * https://github.com/redis/redis/releases/tag/8.2.2\n  * Fixed Lua script may lead to remote code execution (CVE-2025-49844).\n  * Fixed Lua script may lead to integer overflow (CVE-2025-46817).\n  * Fixed Lua script can be executed in the context of another user\n    (CVE-2025-46818).\n  * Fixed LUA out-of-bound read (CVE-2025-46819).\n  * Fixed potential crash on Lua script or streams and HFE defrag.\n  * Fixed potential crash when using ACL rules.\n  * Added VSIM: new EPSILON argument to specify maximum distance.\n  * Added SVS-VAMANA: allow use of BUILD_INTEL_SVS_OPT flag.\n  * Added RESP3 serialization performance.\n  * Added INFO SEARCH: new SVS-VAMANA metrics.\n\n- Updated to 8.2.1\n  * https://github.com/redis/redis/releases/tag/8.2.1\n  - Bug fixes\n    * #14240 INFO KEYSIZES - potential incorrect histogram updates\n      on cluster mode with modules\n    * #14274 Disable Active Defrag during flushing replica\n    * #14276 XADD or XTRIM can crash the server after loading RDB\n    * #Q6601 Potential crash when running FLUSHDB (MOD-10681)\n  * Performance and resource utilization\n    * Query Engine - LeanVec and LVQ proprietary Intel\n      optimizations were removed from Redis Open Source\n    * #Q6621 Fix regression in INFO (MOD-10779)\n","status":"published","published":"2025-12-30T17:05:45Z","modified":"2026-03-23T04:54:17.70898Z","updated_at":"2026-11-02T16:58:38.101535Z"}]}}