Skip to main content
CVE-2025-32023VulnerabilityPublished Updated

Red Hat Security Advisory: redis security update

Affects Red Hat redisSource GCVE Database

0
Compare

Mentioned vulnerabilities

Public exploit available (Exploit-DB).

Data as of 30 Oct 2026, 21:51 UTC

Severity
High

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS
6.4% chance of exploitation in 30 days – higher than 93% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

t = 0 is the CVE’s publication on cve.org

  1. Disclosed: evidence found.

    CVE published 21 Jul 2025

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponized: evidence found.

    1 Exploit-DB entry, 198 days after disclosure

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

Timeline

  1. CVE published

    on cve.org

    , t = 0

  2. First Exploit-DB entry (opens in a new tab)

    Redis 8.0.2 - RCE

    , 198 days after disclosure

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

What to do

AI-suggested

Red Hat has released updated Redis packages to address these vulnerabilities. Users should apply the security update for Redis as provided in Red Hat Enterprise Linux 9 and its variants. The advisory and update instructions are available at https://access.redhat.com/articles/11258. Since the update is available, applying the official fix is the recommended mitigation. No additional mitigation steps are indicated by the vendor.

Description

Two security vulnerabilities have been identified in Redis, an advanced key-value store used for in-memory data storage. The first is an unauthenticated denial of service vulnerability (CVE-2025-48367), and the second is a Hyperloglog out-of-bounds write vulnerability (CVE-2025-32023). These issues affect Redis packages distributed with Red Hat Enterprise Linux 9 and its variants. Red Hat has issued a security advisory and released updated packages to address these vulnerabilities. No public exploitation in the wild has been reported, but public exploit code is available. The update is rated as having an important security impact by Red Hat Product Security.

References

Community reviews

Loading reviews…