CVE-2025-49112: valkey Integer Underflow (Wrap or Wraparound)
CVSS: 3.1v3.1LowDeferred
AliasesUBUNTU-CVE-2025-49112DEBIAN-CVE-2025-49112CGA-287v-7hx3-vcg6CGA-3g6v-36rg-qrxwCGA-53h2-6x88-8r35CGA-5548-fhch-5jmgCGA-6g3f-q9gr-359vCGA-8j96-qmw9-83mcCGA-8qw4-534x-3v6qCGA-949f-mmr7-9f72CGA-9jrf-68fh-6w24CGA-cff4-v4f2-jr7xCGA-cjm8-c474-r83hCGA-cmm3-9jc2-j766CGA-cph4-f6g8-c3cfCGA-g9jr-m7hc-59c7CGA-h648-59w5-96hqCGA-j78g-r8cq-xgj2CGA-mchj-58xj-78mmCGA-mg9c-rmc8-wjw9CGA-mq3q-g5cm-3ccwCGA-mxhw-92rw-wjjxCGA-p2qg-4348-pcpmCGA-p6rj-c598-6rrxCGA-p757-8vr2-57m3CGA-pv94-g87j-8c3jCGA-vf4v-x72f-qm43CGA-vvw8-56fg-q69xCGA-w5fg-mvq3-vhcfCGA-x969-6p7h-5jp9
Published 02-06-2025Last modified 02-06-2025
Vulnerability summary
CVE-2025-49112 is a low (CVSS 3.1) Integer Underflow (Wrap or Wraparound) vulnerability in valkey. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 15% of scored vulnerabilities.
CVSS score
3.1/10
010
Low · v3.1 (CVE.org)EPSS score
0.25%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 4 · Related 5Timeline
- 02-06-2025PublishedVulnerability first disclosed.
- 02-06-2025Last modifiedVulnerability information updated.
Description
setDeferredReply in networking.c in Valkey through 8.1.1 has an integer underflow for prev->size - prev->used.
CVSS metrics
5 scores · 5 sources · 1 versionLow 3.1Preferred score · CVE.org (CNA)
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:LSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated3.1LowCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · DebianEcosystem advisory · calculated3.1LowCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · ChainguardEcosystem advisory · calculated3.1LowCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
- NVDNIST3.1LowCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS trend
Probability
0.25%
Chance of exploitation in the next 30 days
Percentile
15%
Versus all other CVEs
30-day change
0.00 pp
From 0.25% on 19-09-2026
19-09-202619-10-2026
EPSS score0.25%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard14 products
- py3-redisAll versions (No fix recorded)
- py3.10-redisAll versions (No fix recorded)
- py3.11-redisAll versions (No fix recorded)
- py3.12-redisAll versions (No fix recorded)
- py3.13-redisAll versions (No fix recorded)
Debian3 products
- redict< 7.3.5+ds-1
- redisAll versions (No fix recorded)
- valkey< 8.1.1+dfsg1-2
Ubuntu3 products
- redictAll versions (No fix recorded)
- redisAll versions (No fix recorded)
- valkey< 7.2.11+dfsg1-0ubuntu0.2 | < 8.1.4+dfsg1-0ubuntu0.2
Valkey1 product
- valkey≤ 8.1.1
4 vendors · 21 products
