7.5

CVE-2025-21605: debian debian_linux

CVSS: 7.5v3.1HighModified
AliasesALPINE-CVE-2025-21605MGASA-2025-0171SUSE-SU-2025:02010-1
Published 23-04-2025Last modified 10-02-2026
Open JSON

Vulnerability summary

CVE-2025-21605 is a high (CVSS 7.5) vulnerability in debian debian_linux. EPSS estimates a 0.86% chance of exploitation in the next 30 days, higher than 57.7% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.86%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 3
OPENSUSE-SU-2025:15293-1SUSE-SU-2025:01942-1CGA-72M5-FRJ4-6595

Timeline

  1. 23-04-2025
    PublishedVulnerability first disclosed.
  2. 10-02-2026
    Last modifiedVulnerability information updated.

Description

Redis is an open source, in-memory database that persists on disk. In versions starting at 2.6 and prior to 7.4.3, An unauthenticated client can cause unlimited growth of output buffers, until the server runs out of memory or is killed. By default, the Redis configuration does not limit the output buffer of normal clients (see client-output-buffer-limit). Therefore, the output buffer can grow unlimitedly over time. As a result, the service is exhausted and the memory is unavailable. When password authentication is enabled on the Redis server, but no password is provided, the client can still cause the output buffer to grow from "NOAUTH" responses until the system will run out of memory. This issue has been patched in version 7.4.3. An additional workaround to mitigate this problem without patching the redis-server executable is to block access to prevent unauthenticated users from connecting to Redis. This can be done in different ways. Either using network access control tools like firewalls, iptables, security groups, etc, or enabling TLS and requiring users to authenticate using client side certificates.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.86%

Chance of exploitation in the next 30 days

Percentile

58%

Versus all other CVEs

30-day change

0.00 pp

From 0.86% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.86%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse21 products
  • redis7&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 7.0.8-150500.3.18.1
  • redis7&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS< 7.0.8-150500.3.18.1
  • redis7&distro=SUSE Linux Enterprise Module for Server Applications 15 SP6< 7.0.8-150600.8.9.1
  • redis7&distro=SUSE Linux Enterprise Server 15 SP5-LTSS< 7.0.8-150500.3.18.1
  • redis7&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP5< 7.0.8-150500.3.18.1
Redhat11 products
  • discovery-cli< 0:1.14.0-1.el8 | < 0:1.14.0-1.el9
  • discovery-installer< 0:1.14.1-1.el8 | < 0:1.14.1-1.el9
  • redis< 0:6.0.9-5.module+el8.4.0+23067+0d16e377.2 | < 0:6.0.9-5.module+el8.6.0+23072+c1b08039.2 | < 0:6.2.6-1.el9_0.2 | < 0:6.2.7-1.module+el8.8.0+23086+95b1dcd4.3 | < 0:6.2.7-1.el9_4.2 | < 0:6.2.7-1.el9_2.2 | < 0:7.2.8-1.module+el9.6.0+23049+8374f320 | < 0:6.2.18-1.el9_6 | < 0:7.0.12-1.module+el9.4.0+23090+d27b104d.3 | < 0:6.2.18-1.module+el8.10.0+23050+05ea4e95
  • redis-debuginfo< 0:6.0.9-5.module+el8.4.0+23067+0d16e377.2 | < 0:6.0.9-5.module+el8.6.0+23072+c1b08039.2 | < 0:6.2.6-1.el9_0.2 | < 0:6.2.7-1.module+el8.8.0+23086+95b1dcd4.3 | < 0:6.2.7-1.el9_4.2 | < 0:6.2.7-1.el9_2.2 | < 0:7.2.8-1.module+el9.6.0+23049+8374f320 | < 0:6.2.18-1.el9_6 | < 0:7.0.12-1.module+el9.4.0+23090+d27b104d.3 | < 0:6.2.18-1.module+el8.10.0+23050+05ea4e95
  • redis-debugsource< 0:6.0.9-5.module+el8.4.0+23067+0d16e377.2 | < 0:6.0.9-5.module+el8.6.0+23072+c1b08039.2 | < 0:6.2.6-1.el9_0.2 | < 0:6.2.7-1.module+el8.8.0+23086+95b1dcd4.3 | < 0:6.2.7-1.el9_4.2 | < 0:6.2.7-1.el9_2.2 | < 0:7.2.8-1.module+el9.6.0+23049+8374f320 | < 0:6.2.18-1.el9_6 | < 0:7.0.12-1.module+el9.4.0+23090+d27b104d.3 | < 0:6.2.18-1.module+el8.10.0+23050+05ea4e95
Chainguard7 products
  • py3-redisAll versions (No fix recorded)
  • py3.10-redisAll versions (No fix recorded)
  • py3.11-redisAll versions (No fix recorded)
  • py3.12-redisAll versions (No fix recorded)
  • py3.13-redisAll versions (No fix recorded)
Debian4 products
  • redict< 7.3.5+ds-1
  • redis< 5:7.0.15-1~deb12u4 | < 5:7.0.15-3.1 | < 5:6.0.16-1+deb11u6
  • valkey< 8.1.1+dfsg1-1
  • debian_linuxEOL11.0
Opensuse4 products
  • redis7&distro=openSUSE Leap 15.6< 7.0.8-150600.8.9.1
  • redis&distro=openSUSE Leap 15.6< 7.2.4-150600.3.9.1
  • valkey&distro=openSUSE Leap 15.6< 8.0.2-150600.13.6.1
  • valkey&distro=openSUSE Tumbleweed< 8.0.3-1.1
Ubuntu3 products
  • redictAll versions (No fix recorded)
  • redisAll versions (No fix recorded)
  • valkey< 7.2.11+dfsg1-0ubuntu0.2
Alpine2 products
  • redis≥ 2.6.0, < 6.2.18-r0 | ≥ 2.6.0, < 7.0.15-r3 | ≥ 2.6.0, < 7.2.8-r0
  • valkey≥ 7.2.4, < 7.2.9-r0
Lfprojects1 product
  • valkey≥ 7.2.4, < 7.2.9 | ≥ 8.0.0, < 8.0.3 | ≥ 8.1.0, < 8.1.1
Mageia1 product
  • redis< 7.0.14-1.3.mga9
Redis1 product
  • redis≥ 2.6, < 7.4.3 | ≥ 2.6.0, < 6.2.18 | ≥ 7.0, < 7.2.8 | ≥ 7.4.0, < 7.4.3

10 vendors · 55 products

References

53 links
Show all 53 references