Unrated severityNVD Advisory· Published May 29, 2025· Updated May 29, 2025
redis-check-aof may lead to stack overflow and potential RCE
CVE-2025-27151
Description
Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a stack-based buffer overflow exists in redis-check-aof due to the use of memcpy with strlen(filepath) when copying a user-supplied file path into a fixed-size stack buffer. This allows an attacker to overflow the stack and potentially achieve code execution. This issue has been patched in version 8.0.2.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
39- osv-coords37 versionspkg:apk/chainguard/py3.10-redispkg:apk/chainguard/py3.11-redispkg:apk/chainguard/py3.12-redispkg:apk/chainguard/py3.13-redispkg:apk/chainguard/py3-redispkg:apk/chainguard/redis-7.2pkg:apk/chainguard/redis-7.2-iamguarded-compatpkg:apk/chainguard/redis-7.4pkg:apk/chainguard/redis-benchmark-7.2pkg:apk/chainguard/redis-cli-7.2pkg:apk/chainguard/redis-cluster-7.2-iamguarded-compatpkg:apk/chainguard/redis-sentinel-7.2-iamguarded-compatpkg:apk/wolfi/redis-7.2pkg:apk/wolfi/redis-7.4pkg:apk/wolfi/redis-benchmark-7.2pkg:apk/wolfi/redis-cli-7.2pkg:bitnami/keydbpkg:bitnami/redispkg:bitnami/valkeypkg:rpm/almalinux/redispkg:rpm/almalinux/redis-develpkg:rpm/almalinux/redis-docpkg:rpm/almalinux/valkeypkg:rpm/almalinux/valkey-develpkg:rpm/opensuse/redis7&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/redis&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/redis&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/valkey&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/valkey&distro=openSUSE%20Tumbleweedpkg:rpm/suse/redis7&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOSpkg:rpm/suse/redis7&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSSpkg:rpm/suse/redis7&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP6pkg:rpm/suse/redis7&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSSpkg:rpm/suse/redis7&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5pkg:rpm/suse/redis&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP6pkg:rpm/suse/valkey&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP6pkg:rpm/suse/valkey&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP7
< 0+ 36 more
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 7.2.9-r1
- (no CPE)range: < 7.2.12-r2
- (no CPE)range: < 7.4.4-r1
- (no CPE)range: < 7.2.12-r2
- (no CPE)range: < 7.2.12-r2
- (no CPE)range: < 7.2.12-r2
- (no CPE)range: < 7.2.12-r2
- (no CPE)range: < 7.2.9-r1
- (no CPE)range: < 7.4.4-r1
- (no CPE)range: < 7.2.12-r2
- (no CPE)range: < 7.2.12-r2
- (no CPE)range: >= 7.0.0
- (no CPE)range: >= 7.0.0, < 7.2.9
- (no CPE)range: < 7.2.10
- (no CPE)range: < 7.2.10-1.module_el9.6.0+173+efaf9205
- (no CPE)range: < 7.2.10-1.module_el9.6.0+173+efaf9205
- (no CPE)range: < 7.2.10-1.module_el9.6.0+173+efaf9205
- (no CPE)range: < 8.0.4-1.el10_0
- (no CPE)range: < 8.0.4-1.el10_0
- (no CPE)range: < 7.0.8-150600.8.16.1
- (no CPE)range: < 7.2.4-150600.3.12.1
- (no CPE)range: < 8.0.2-1.1
- (no CPE)range: < 8.0.2-150600.13.11.1
- (no CPE)range: < 8.1.2-1.1
- (no CPE)range: < 7.0.8-150500.3.21.1
- (no CPE)range: < 7.0.8-150500.3.21.1
- (no CPE)range: < 7.0.8-150600.8.16.1
- (no CPE)range: < 7.0.8-150500.3.21.1
- (no CPE)range: < 7.0.8-150500.3.21.1
- (no CPE)range: < 7.2.4-150600.3.12.1
- (no CPE)range: < 8.0.2-150600.13.11.1
- (no CPE)range: < 8.0.2-150700.3.5.1
Patches
Vulnerability mechanics
References
3- github.com/redis/redis/commit/643b5db235cb82508e72f11c7b4bbfc7dc39be56mitrex_refsource_MISC
- github.com/redis/redis/releases/tag/8.0.2mitrex_refsource_MISC
- github.com/redis/redis/security/advisories/GHSA-5453-q98w-cmvmmitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.