A critical vulnerability has been identified in Redis, the widely used open-source in-memory data store, that could enable unauthenticated attackers to trigger denial-of-service (DoS) conditions by overwhelming server memory resources.
Cataloged as CVE-2025-21605 and carrying a CVSS severity score of 7.5, this flaw impacts all Redis versions starting from 2.6 and represents a major threat to publicly accessible Redis deployments.
Redis Memory Exhaustion Flaw
At its core, the vulnerability arises from a design flaw in Redis’s output buffer management system, leaving it susceptible to memory exhaustion attacks under specific conditions.
By default, Redis does not enforce output buffer limits for standard clients via the client-output-buffer-limit setting.
This design oversight enables output buffers to expand unchecked, potentially consuming all available server memory — a particularly dangerous flaw given that no authentication is required to exploit it.
Even if a Redis instance is password-protected, attackers can still trigger the vulnerability by simply sending unauthenticated requests.
Each failed login attempt generates a “NOAUTH” error message, which accumulates in the output buffer. Over time, these responses build up, eventually exhausting server memory and causing crashes or forced shutdowns.
“An unauthenticated client can cause unlimited growth of output buffers, until the server runs out of memory or is killed,” Redis maintainers highlighted in their official security advisory.
The vulnerability, responsibly reported by security researcher @polaris-alioth, highlights the continued collaboration between the Redis project and the broader cybersecurity community.
Risk Summary
| Category | Details |
|---|---|
| Affected Products | Redis versions from 2.6 up to versions prior to the patched releases |
| Impact | Denial of Service (DoS) |
| Exploit Requirements | No authentication or privileges needed; network access to the Redis server |
| CVSS 3.1 Score | 7.5 (High) |
Technical Insights
This issue stems from how Redis manages client connections:
When a client connects without authenticating — for example, using unauthorized commands — Redis continues to generate error messages without clearing the output buffer, leading to unbounded memory usage.
Although this vulnerability does not directly affect data confidentiality or integrity, it poses a serious threat to service availability, justifying its high severity rating.
Patched versions and remediation guidance have been made available, and organizations are strongly urged to update vulnerable instances immediately.
Each unauthorized command sent to a Redis server generates error responses that occupy space within the server’s output buffer. Due to the lack of enforced buffer limits, these error messages can accumulate without restriction, eventually overwhelming server memory.
Affected Versions and Patch Details
This vulnerability impacts all Redis versions from 2.6 up to the following patched releases:
- Redis OSS/CE: 7.4.3 and later
- Redis OSS/CE: 7.2.8 and later
- Redis OSS/CE: 6.2.18 and later
- Redis Stack: 7.4.0-v4 and later
- Redis Stack: 7.2.0-v16 and later
- Redis Stack: 6.2.6-v20 and later
Redis Cloud services have already been updated to incorporate the necessary security patches, requiring no intervention from customers utilizing managed cloud deployments.
However, organizations that self-host Redis instances should prioritize upgrading to a patched release immediately.
Mitigation Guidance
For environments where immediate upgrades aren’t feasible, Redis maintainers recommend several interim mitigation strategies:
- Enforce strict network controls: Use firewalls, iptables, or cloud security groups to restrict unauthorized access.
- Enable TLS encryption: Require client authentication through certificates to validate connections.
- Set output buffer limits: Properly configure
client-output-buffer-limitsettings to cap memory usage.
Redis maintainers emphasize that public exposure of a Redis endpoint significantly increases the risk associated with this vulnerability. As stated in their advisory:
“Exposure to this vulnerability requires a Redis endpoint to be publicly exposed.”
Organizations leveraging Redis within their infrastructure should immediately assess their exposure, apply patches where possible, and implement strong network security measures to minimize risk.
