CVE-2025-48367: redis
CVSS: 7.5v3.1HighAnalyzed
AliasesALPINE-CVE-2025-48367UBUNTU-CVE-2025-48367DEBIAN-CVE-2025-48367CGA-28q3-rvpc-3wxhCGA-2jv9-2j82-q4f2CGA-2jww-9m3c-7246CGA-2wr4-w6hh-c29qCGA-55jc-p5cf-3vh8CGA-5h47-9vpw-q7w8CGA-5wm7-mr72-f9pgCGA-5wxm-2r98-r7mwCGA-67qj-6fqj-wrhqCGA-6823-cwcf-xrxpCGA-6jmp-cgrm-r2wfCGA-7j56-3qp3-vwmgCGA-882w-cp3m-r2pfCGA-95w7-2m46-6px6CGA-c4j6-4mh2-7xqjCGA-cm9q-2w9v-cqxqCGA-cx6f-23cm-3qv6CGA-fv38-jq5w-r2vcCGA-gh9x-g6pp-9m79CGA-h3f2-fm3v-gjxgCGA-j86q-6x5m-7qvmCGA-jqg2-8644-qx3pCGA-p85h-h6pw-c46cCGA-p9cr-gx7f-p435CGA-r596-27vx-qwccCGA-rrmj-x3qw-xq8jCGA-rw64-4738-42hfCGA-v9f5-2v3v-4vr6
Published 07-07-2025Last modified 07-07-2025
Vulnerability summary
CVE-2025-48367 is a high (CVSS 7.5) vulnerability in redis. EPSS estimates a 1.19% chance of exploitation in the next 30 days, higher than 67.4% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
1.19%
0%100%
Low · +0.13 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 23 · Related 13DLA-4240-1DSA-5969-1MGASA-2025-0211OPENSUSE-SU-2025:15318-1OPENSUSE-SU-2025:15359-1RHSA-2025:11401RHSA-2025:11453RHSA-2025:12006RHSA-2025:12008RHSA-2025:12468RHSA-2025:12478RHSA-2025:12524RHSA-2025:12768RHSA-2025:12769RHSA-2025:12789RHSA-2025:12892SUSE-SU-2025:02579-1SUSE-SU-2025:02593-1SUSE-SU-2025:02594-1SUSE-SU-2025:02679-1SUSE-SU-2025:02680-1SUSE-SU-2025:02681-1SUSE-SU-2025:03073-1CGA-2J5X-QR8R-X828CGA-MQC4-2W23-VGP8CGA-QF74-H4HX-MQMJCGA-RW99-53W6-FP3F
Timeline
- 07-07-2025PublishedVulnerability first disclosed.
- 07-07-2025Last modifiedVulnerability information updated.
Description
Redis is an open source, in-memory database that persists on disk. An unauthenticated connection can cause repeated IP protocol errors, leading to client starvation and, ultimately, a denial of service. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19.
CVSS metrics
6 scores · 6 sources · 1 versionHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 6 agree
- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.19%
Chance of exploitation in the next 30 days
Percentile
67%
Versus all other CVEs
30-day change
+0.13 pp
From 1.06% on 18-09-2026
18-09-202618-10-2026
EPSS score1.19%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard14 products
- py3-redisAll versions (No fix recorded)
- py3.10-redisAll versions (No fix recorded)
- py3.11-redisAll versions (No fix recorded)
- py3.12-redisAll versions (No fix recorded)
- py3.13-redisAll versions (No fix recorded)
Debian3 products
- redict< 7.3.5+ds-1
- redis< 5:7.0.15-1~deb12u5 | < 5:8.0.2-2
- valkey< 8.1.1+dfsg1-3
Ubuntu3 products
- redictAll versions (No fix recorded)
- redisAll versions (No fix recorded)
- valkey< 7.2.11+dfsg1-0ubuntu0.2
Alpine1 product
- valkey< 7.2.11-r0 | < 8.1.1-r2
Redis1 product
- redis≥ 7.4-rc1, < 7.4.5 | ≥ 7.0.0, < 7.2.10 | < 6.2.19 | ≥ 7.0, < 7.2.10 | ≥ 7.4.0, < 7.4.5 | ≥ 8.0.0, < 8.0.3
5 vendors · 22 products
References
14 links- github.com/redis/redis/security/advisories/GHSA-4q32-c38c-pwgqX Refsource CONFIRMREPORTAdvisoryThird Party Advisory
- github.com/redis/redis/commit/bde62951accfc4bb0a516276fd0b4b307e140ce2X Refsource MISCREPORTFIXPatch
