REDHAT-BUG-2376858: High severity Redis redis vulnerability

Published Jul 7, 2025
·
Updated

Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially leading to remote code execution. The bug likely affects all Redis versions with hyperloglog operations implemented. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing hyperloglog operations. This can be done using ACL to restrict HLL commands.

Affected Software

2 affected components
Redis redis>=2.8<8.0.3
Redis redis

Event History

Jul 7, 2025
Data Sourced
via Red Hat·04:01 PM
DescriptionSeverityAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of REDHAT-BUG-2376858?

REDHAT-BUG-2376858 is classified as a critical vulnerability due to its potential for remote code execution.

2

How do I fix REDHAT-BUG-2376858?

To fix REDHAT-BUG-2376858, upgrade your Redis installation to version 8.0.3 or a later version.

3

What versions of Redis are affected by REDHAT-BUG-2376858?

REDHAT-BUG-2376858 affects Redis versions from 2.8 to before 8.0.3, including specific versions 7.4.5, 7.2.10, and 6.2.19.

4

What kind of exploit can REDHAT-BUG-2376858 lead to?

REDHAT-BUG-2376858 can lead to remote code execution due to an authenticated user's ability to trigger a stack/heap out of bounds write.

5

Is authentication required to exploit REDHAT-BUG-2376858?

Yes, an authenticated user is required to exploit REDHAT-BUG-2376858.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203