CVE-2025-32023

Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially leading to remote code execution. The bug likely affects all Redis versions with hyperloglog operations implemented. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing hyperloglog operations. This can be done using ACL to restrict HLL commands.

• CWE-680

• https://github.com/redis/redis/commit/50188747cbfe43528d2719399a2a3c9599169445Patch
• https://github.com/redis/redis/releases/tag/6.2.19Release Notes
• https://github.com/redis/redis/releases/tag/7.2.10Release Notes
• https://github.com/redis/redis/releases/tag/7.4.5Release Notes
• https://github.com/redis/redis/releases/tag/8.0.3Release Notes
• https://github.com/redis/redis/security/advisories/GHSA-rp2m-q4j6-gr43Third Party Advisory
• https://www.exploit-db.com/exploits/52477

Published

Jul 7, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-32018Cursor is a code editor built for programming with AI. In ve…8
• CVE-2025-32019Harbor is an open source trusted cloud native registry proje…4.1
• CVE-2025-3202A vulnerability classified as critical has been found in age…9.1
• CVE-2025-32020The crud-query-parser library parses query parameters from H…9.3
• CVE-2025-32021Weblate is a web based localization tool. Prior to version 5…7.5
• CVE-2025-32022Finit provides fast init for Linux systems. Finit's urandom …4.6
• CVE-2025-32024bep/imagemeta is a Go library for reading EXIF, IPTC and XMP…6.9
• CVE-2025-32025bep/imagemeta is a Go library for reading EXIF, IPTC and XMP…6.9
• CVE-2025-32026Element Web is a Matrix web client built using the Matrix Re…3.8
• CVE-2025-32027Yii is an open source PHP web framework. Prior to 1.1.31, yi…6.1
• CVE-2025-32028HAX CMS PHP allows you to manage your microsite universe wit…9.9
• CVE-2025-32029ts-asn1-der is a collection of utility classes to encode ASN…6.9