CVE-2025-27151
Medium
Description
Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a stack-based buffer overflow exists in redis-check-aof due to the use of memcpy with strlen(filepath) when copying a user-supplied file path into a fixed-size stack buffer. This allows an attacker to overflow the stack and potentially achieve code execution. This issue has been patched in version 8.0.2.
SeverityMedium
CVSS4.7
Exploit probability—
Product
Redis
PublishedMay 29, 2025
First seenMay 29, 2025
Weakness typeCWE-20Improper input validationCWE-121CWE-121
How to fix
Update
- redis redis7.2.9, 7.4.4, 8.0.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redis redis | 7.0.0 ≤ v < 7.2.9, 7.4.0 ≤ v < 7.4.4, 8.0.0 ≤ v < 8.0.2 | 7.2.9, 7.4.4, 8.0.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.