Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client (CVE-2025-21605)
Redis is an open source, in-memory database that persists on disk. In versions starting at 2.6 and prior to 7.4.3, An unauthenticated client can cause unlimited growth of output buffers, until the server runs out of memory or is killed. By default, the Redis configuration does not limit the output buffer of normal clients (see client-output-buffer-limit). Therefore, the output buffer can grow unlimitedly over time. As a result, the service is exhausted and the memory is unavailable. When password authentication is enabled on the Redis server, but no password is provided, the client can still cause the output buffer to grow from "NOAUTH" responses until the system will run out of memory. This issue has been patched in version 7.4.3. An additional workaround to mitigate this problem without patching the redis-server executable is to block access to prevent unauthenticated users from connecting to Redis. This can be done in different ways. Either using network access control tools like firewalls, iptables, security groups, etc, or enabling TLS and requiring users to authenticate using client side certificates.
AI Analysis
Technical Summary
The vulnerability identified as CVE-2025-21605 affects Redis, an advanced in-memory key-value store used in Red Hat Enterprise Linux distributions. The flaw involves unlimited growth of output buffers when abused by unauthenticated clients, leading to a denial of service condition. This can cause Redis to consume excessive resources, potentially impacting availability. Red Hat has issued security advisories and updates for Redis versions included in RHEL 8.4 and 9 to mitigate this issue.
Potential Impact
An unauthenticated attacker can exploit this vulnerability to cause a denial of service by triggering unlimited growth of Redis output buffers. This results in resource exhaustion, potentially causing the Redis service to become unresponsive or crash, impacting availability of services relying on Redis.
Mitigation Recommendations
Red Hat has released official security updates that fix this vulnerability. Users should apply the provided Redis updates for Red Hat Enterprise Linux 8.4 and 9 as detailed in the Red Hat advisories and articles (https://access.redhat.com/articles/11258). Applying these updates will mitigate the risk of denial of service due to this vulnerability.
Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client (CVE-2025-21605)
Description
Redis is an open source, in-memory database that persists on disk. In versions starting at 2.6 and prior to 7.4.3, An unauthenticated client can cause unlimited growth of output buffers, until the server runs out of memory or is killed. By default, the Redis configuration does not limit the output buffer of normal clients (see client-output-buffer-limit). Therefore, the output buffer can grow unlimitedly over time. As a result, the service is exhausted and the memory is unavailable. When password authentication is enabled on the Redis server, but no password is provided, the client can still cause the output buffer to grow from "NOAUTH" responses until the system will run out of memory. This issue has been patched in version 7.4.3. An additional workaround to mitigate this problem without patching the redis-server executable is to block access to prevent unauthenticated users from connecting to Redis. This can be done in different ways. Either using network access control tools like firewalls, iptables, security groups, etc, or enabling TLS and requiring users to authenticate using client side certificates.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability identified as CVE-2025-21605 affects Redis, an advanced in-memory key-value store used in Red Hat Enterprise Linux distributions. The flaw involves unlimited growth of output buffers when abused by unauthenticated clients, leading to a denial of service condition. This can cause Redis to consume excessive resources, potentially impacting availability. Red Hat has issued security advisories and updates for Redis versions included in RHEL 8.4 and 9 to mitigate this issue.
Potential Impact
An unauthenticated attacker can exploit this vulnerability to cause a denial of service by triggering unlimited growth of Redis output buffers. This results in resource exhaustion, potentially causing the Redis service to become unresponsive or crash, impacting availability of services relying on Redis.
Mitigation Recommendations
Red Hat has released official security updates that fix this vulnerability. Users should apply the provided Redis updates for Red Hat Enterprise Linux 8.4 and 9 as detailed in the Red Hat advisories and articles (https://access.redhat.com/articles/11258). Applying these updates will mitigate the risk of denial of service due to this vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:7686
- Cve Count
- 1
Threat ID: 6a4049e727e9c79719834c53
Added to database: 06/27/2026, 22:08:39 UTC
Last enriched: 08/07/2026, 16:22:07 UTC
Last updated: 09/10/2026, 19:36:49 UTC
Views: 19
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.