CVE-2025-27151

Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a stack-based buffer overflow exists in redis-check-aof due to the use of memcpy with strlen(filepath) when copying a user-supplied file path into a fixed-size stack buffer. This allows an attacker to overflow the stack and potentially achieve code execution. This issue has been patched in version 8.0.2.

References

Affected packages

Git / github.com/redis/redis

Affected ranges

Type: GIT
Repo: https://github.com/redis/redis
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

643b5db235cb82508e72f11c7b4bbfc7dc39be56

Fixed

994bc96bb1744cb153392fc96bdba43eae56e17f

Affected versions

1.*

1.3.6

2.*

2.2-alpha0

2.2-alpha1

2.2-alpha2

2.2-alpha3

2.2-alpha4

2.2-alpha5

2.2-alpha6

2.2.0-rc1

2.3-alpha0

3.*

3.0-alpha0

8.*

8.0-m01

8.0-m02

8.0-m03

8.0-m04

8.0-m04-int

8.0-rc1

8.0-rc1-int

8.0-rc1-int2

8.0-rc2-int

8.0.0

8.0.1

8.0.1-int

v1.*

v1.3.10

v1.3.11

v1.3.12

v1.3.7

v1.3.8

v1.3.9

v2.*

v2.0.0-rc1

v2.1.1-watch

Other

vm-playpen

with-deprecated-diskstore

Database specific

{
    "vanir_signatures": [
        {
            "id": "CVE-2025-27151-3559ed69",
            "digest": {
                "line_hashes": [
                    "204361133470043369422735108006951014492",
                    "266395016474126643708905170881553865497",
                    "291104153020075789859589203955995153601"
                ],
                "threshold": 0.9
            },
            "target": {
                "file": "src/redis-check-aof.c"
            },
            "source": "https://github.com/redis/redis/commit/643b5db235cb82508e72f11c7b4bbfc7dc39be56",
            "signature_version": "v1",
            "deprecated": false,
            "signature_type": "Line"
        },
        {
            "id": "CVE-2025-27151-bc576423",
            "digest": {
                "length": 1359.0,
                "function_hash": "327466512985566197169610813840867666992"
            },
            "target": {
                "function": "redis_check_aof_main",
                "file": "src/redis-check-aof.c"
            },
            "source": "https://github.com/redis/redis/commit/643b5db235cb82508e72f11c7b4bbfc7dc39be56",
            "signature_version": "v1",
            "deprecated": false,
            "signature_type": "Function"
        }
    ]
}