CVE-2025-32023
📋 TL;DR
This CVE describes a memory corruption vulnerability in Redis hyperloglog operations that allows authenticated users to trigger out-of-bounds writes. Successful exploitation could lead to remote code execution on affected Redis servers. The vulnerability affects Redis versions from 2.8 up to (but not including) 8.0.3, 7.4.5, 7.2.10, and 6.2.19.
💻 Affected Systems
- Redis
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the Redis process, potentially leading to complete system compromise.
Likely Case
Redis service crash (denial of service) or limited memory corruption leading to unstable behavior.
If Mitigated
No impact if hyperloglog operations are disabled via ACL or the vulnerability is patched.
🎯 Exploit Status
Exploitation requires authenticated access and knowledge of hyperloglog operations. The vulnerability involves memory corruption which can be complex to weaponize reliably.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.0.3, 7.4.5, 7.2.10, or 6.2.19
Vendor Advisory: https://github.com/redis/redis/releases
Restart Required: Yes
Instructions:
1. Identify current Redis version using 'redis-server --version'. 2. Download and install the appropriate patched version from Redis GitHub releases. 3. Stop Redis service. 4. Replace the redis-server binary with the patched version. 5. Restart Redis service.
🔧 Temporary Workarounds
Disable hyperloglog operations via ACL
allPrevents authenticated users from executing hyperloglog commands that trigger the vulnerability
ACL SETUSER <username> -@hyperloglog
ACL SETUSER <username> -PFADD -PFCOUNT -PFMERGE
🧯 If You Can't Patch
- Implement strict network access controls to limit Redis exposure to trusted networks only
- Use Redis ACL to restrict all user permissions to minimum required operations
🔍 How to Verify
Check if Vulnerable:
Check Redis version with 'redis-server --version'. If version is between 2.8 and before the patched versions listed, and hyperloglog operations are enabled, the system is vulnerable.Check Version:
redis-server --versionVerify Fix Applied:
Verify Redis version is 8.0.3, 7.4.5, 7.2.10, or 6.2.19 or later using 'redis-server --version'📡 Detection & Monitoring
Log Indicators:
- Unexpected Redis crashes or restarts
- Hyperloglog command failures or unusual patterns in Redis logs
Network Indicators:
- Unusual hyperloglog command traffic from authenticated users
- Multiple PFADD/PFCOUNT/PFMERGE commands in short succession
SIEM Query:
source="redis.log" AND (command="PFADD" OR command="PFCOUNT" OR command="PFMERGE") | stats count by src_ip🔗 References
- https://github.com/redis/redis/commit/50188747cbfe43528d2719399a2a3c9599169445
- https://github.com/redis/redis/releases/tag/6.2.19
- https://github.com/redis/redis/releases/tag/7.2.10
- https://github.com/redis/redis/releases/tag/7.4.5
- https://github.com/redis/redis/releases/tag/8.0.3
- https://github.com/redis/redis/security/advisories/GHSA-rp2m-q4j6-gr43
- https://www.exploit-db.com/exploits/52477
