CVE-2023-25155

Deeper analysis

Redis is an in-memory database that persists on disk and is affected by CVE-2023-25155, an integer overflow vulnerability (CWE-190) present in all versions. The issue manifests when authenticated users issue specially crafted SRANDMEMBER, ZRANDMEMBER, or HRANDFIELD commands, triggering a runtime assertion that terminates the Redis server process. The vulnerability carries a CVSS score of 5.5, reflecting local access requirements with low attack complexity and privileges but high impact on availability.

Authenticated users with the ability to execute the affected commands can exploit this flaw to cause a denial of service by crashing the Redis instance. Because the attack requires authentication and local vector per the CVSS metrics, it is typically limited to insiders or compromised accounts rather than remote unauthenticated attackers.

Advisories and patches released by the Redis project recommend upgrading to versions 6.0.18, 6.2.11, or 7.0.9, which contain fixes for the integer overflow. The corresponding commits and release notes are available in the project's GitHub repository, along with a detailed security advisory.

The exploitation probability remains low, with an EPSS score peaking at approximately 0.06, indicating limited observed interest in active exploitation following disclosure.