CVE-2023-25155
redis: String matching commands (like SCAN or KEYS) with a specially crafted pattern to trigger a denial-of-service attack
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · February 28, 2023
Updated · August 7, 2026
Description
A vulnerability was found in Redis. This flaw allows authenticated users issuing specially crafted SRANDMEMBER, ZRANDMEMBER, and HRANDFIELD commands to trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-190 · Integer Overflow or Wraparound