CVE-2025-21605

CVE-2025-21605 describes a denial-of-service vulnerability in Redis versions 2.6 through 7.4.2, affecting various Debian and Redis products. An unauthenticated client can cause unlimited growth of output buffers, exhausting server memory even when password authentication is enabled but no password is provided. With a CVSS score of 7.5 (High), this vulnerability has a network attack vector, low attack complexity, and high impact on availability, allowing an attacker to render the service unusable. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE. The issue is patched in Redis 7.4.3, and mitigation includes network access controls or TLS with client-side certificates.