Most recent entries from all

ALSA-2025:11401 — Important: valkey security update

Affected: AlmaLinux:10: valkey, AlmaLinux:10: valkey-devel

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also.

Security Fix(es):

* redis: Redis Stack Buffer Overflow (CVE-2025-27151) * redis: Redis Unauthenticated Denial of Service (CVE-2025-48367) * redis: Redis Hyperloglog Out-of-Bounds Write Vulnerability (CVE-2025-32023)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2025-08608

BELL-CVE-2025-27151

Affected: Alpaquita:23: redis, Alpaquita:stream: redis

BIT-keydb-2025-27151 — redis-check-aof may lead to stack overflow and potential RCE

Affected: Bitnami: keydb

Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a stack-based buffer overflow exists in redis-check-aof due to the use of memcpy with strlen(filepath) when copying a user-supplied file path into a fixed-size stack buffer. This allows an attacker to overflow the stack and potentially achieve code execution. This issue has been patched in version 8.0.2.

certfr-2025-avi-0585 — De multiples vulnérabilités ont été découvertes dans VMware Tanzu. Certaines d'entre elles permettent à un attaquant de…

certfr-2025-avi-0585

EUVD-2026-241717

fkie_cve-2025-27151

msrc_CVE-2025-27151 — redis-check-aof may lead to stack overflow and potential RCE

msrc_CVE-2025-27151

OESA-2025-1630 — redis security update

Affected: openEuler:22.03-LTS-SP3: redis, openEuler:22.03-LTS-SP4: redis, openEuler:24.03-LTS: redis, openEuler:24.03-LTS-SP1: redis, openEuler:20.03-LTS-SP4: redis

Redis is an advanced key-value store. It is often referred to as a dattructure server since keys can contain strings, hashes ,lists, sets anorted sets. Security Fix(es):

setDeferredReply in networking.c in Valkey through 8.1.1 has an integer underflow for prev->size - prev->used.(CVE-2025-49112)

openSUSE-SU-2025:15293-1 — redis-8.0.2-1.1 on GA media

redis-8.0.2-1.1 on GA media

SUSE-SU-2025:02190-1 — Security update for redis

Security update for redis

UBUNTU-CVE-2025-27151

Affected: Ubuntu:24.04:LTS: redis

WID-SEC-W-2025-1150 — Redis: Schwachstelle ermöglicht Denial of Service

Ein lokaler Angreifer kann eine Schwachstelle in Redis ausnutzen, um einen Denial of Service herbeizuführen und poteziell beliebigen Programmcode auszuführen.