CVE-2025-62507: redis Improper Input Validation
Vulnerability summary
CVE-2025-62507 is a high (CVSS 8.8) Improper Input Validation vulnerability in redis. EPSS estimates a 6.79% chance of exploitation in the next 30 days, higher than 93.9% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 04-11-2025PublishedVulnerability first disclosed.
- 26-02-2026Last modifiedVulnerability information updated.
Description
Redis is an open source, in-memory database that persists on disk. In versions 8.2.0 and above, a user can run the XACKDEL command with multiple ID's and trigger a stack buffer overflow, which may potentially lead to remote code execution. This issue is fixed in version 8.2.3. To workaround this issue without patching the redis-server executable is to prevent users from executing XACKDEL operation. This can be done using ACL to restrict XACKDEL command.
CVSS metrics
5 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.7HighCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- NVDNIST7.7HighCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
6.79%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
+0.02 pp
From 6.77% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-121Stack-based Buffer OverflowA stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
Affected systems
Opensuse1 product
- redis&distro=openSUSE Tumbleweed< 8.2.3-1.1
Redis1 product
- redis≥ 8.2.0, < 8.2.3
Ubuntu1 product
- redisAll versions (No fix recorded)
3 vendors · 3 products
References
6 links- github.com/redis/redis/security/advisories/GHSA-jhjx-x4cf-4vm8X Refsource CONFIRMREPORTVendor Advisory