CVE-2025-48367

25

FAUCET Score

CVE-2025-48367 is a high-severity denial-of-service vulnerability affecting Redis versions prior to 8.0.3, 7.4.5, 7.2.10, and 6.2.19. An unauthenticated attacker can exploit this by repeatedly sending IP protocol errors, causing client starvation and rendering the Redis instance unavailable. The vulnerability has a CVSS score of 7.5, indicating a network-based attack with low complexity and high impact on availability. There is currently no public exploit code available, nor is there evidence of active exploitation or significant community discussion.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		< 6.2.19CPE matchmatch criteria	cpe:2.3:a:redis:redis::::::::
		>= 7.0, < 7.2.10CPE matchmatch criteria	cpe:2.3:a:redis:redis::::::::
		>= 7.4.0, < 7.4.5CPE matchmatch criteria	cpe:2.3:a:redis:redis::::::::
		>= 8.0.0, < 8.0.3CPE matchmatch criteria	cpe:2.3:a:redis:redis::::::::

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

Exploitability Score

3.9

Impact Score

3.6

CvssVersion

3.1

Exploit Intelligence

EPSS Score

0.73%

Probability of exploitation in next 30 days

EPSS Percentile

50.6%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0073 is in the 26th percentile among its peer group of 51,551 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (30)

github_advisorypatch availablevia nvd_reference

microsoftpatch availablevia msrc

Product: azl3 valkey 8.0.3-3 on Azure Linux 3.0Fixed in: 8.0.4-1

microsoftpatch availablevia msrc

Product: 19566-16823Fixed in: 6.2.18-3

microsoftpatch availablevia msrc

Product: 20238-17086Fixed in: 6.2.18-3

microsoftpatch availablevia msrc

Product: 19593-17084Fixed in: 8.0.4-1

microsoftpatch availablevia msrc

Product: 19592-17084Fixed in: 8.0.4-1

microsoftpatch availablevia msrc

Product: cm2 redis 6.2.18-3 on CBL Mariner 2.0Fixed in: 6.2.18-3

microsoftpatch availablevia msrc

Product: cbl2 redis 6.2.18-1 on CBL Mariner 2.0Fixed in: 6.2.18-3

microsoftpatch availablevia msrc

Product: azl3 valkey 8.0.4-1 on Azure Linux 3.0Fixed in: 8.0.4-1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.8 Update Services for SAP SolutionsFixed in: redis:6-8080020250730132007.63b34585

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9Fixed in: redis-0:6.2.19-1.el9_6

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9Fixed in: redis:7-9060020250716081121.9

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.0 Update Services for SAP SolutionsFixed in: redis-0:6.2.6-1.el9_0.4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.2 Update Services for SAP SolutionsFixed in: redis-0:6.2.7-1.el9_2.4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.4 Extended Update SupportFixed in: redis-0:6.2.7-1.el9_4.4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.4 Extended Update SupportFixed in: redis:7-9040020250730125543.9

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportFixed in: redis:6-8040020250801055559.522a0ee4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-OnFixed in: redis:6-8040020250801055559.522a0ee4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportFixed in: redis:6-8060020250731141235.ad008a3a

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.6 Telecommunications Update ServiceFixed in: redis:6-8060020250731141235.ad008a3a

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.6 Update Services for SAP SolutionsFixed in: redis:6-8060020250731141235.ad008a3a

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.8 Telecommunications Update ServiceFixed in: redis:6-8080020250730132007.63b34585

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 10Fixed in: valkey-0:8.0.4-1.el10_0

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: redis:6-8100020250716063446.489197e6

redhatno patchvia redhat_api

Product: Red Hat Ansible Automation Platform 2Fixed in: ansible-automation-platform-25/lightspeed-chatbot-rhel8

redhatno patchvia redhat_api

Product: Red Hat Ansible Automation Platform 2Fixed in: automation-controller

redhatno patchvia redhat_api

Product: Red Hat Quay 3Fixed in: quay/quay-rhel8

redhatend of lifevia redhat_api

Product: Red Hat AI Inference ServerFixed in: rhaiis/vllm-cuda-rhel9

redhatend of lifevia redhat_api

Product: Red Hat AI Inference ServerFixed in: rhaiis/vllm-rocm-rhel9

redhatend of lifevia redhat_api

Product: Red Hat Ansible Automation Platform 2Fixed in: ansible-automation-platform-25/aap-cloud-metrics-collector-rhel8

Vendor Advisories (2)

microsoft2025-Jul/CVE-2025-48367Important

Redis DoS Vulnerability due to bad connection error handling

redhatCVE-2025-48367Moderate

redis: Redis Unauthenticated Denial of Service

References

github.com / redis/redis/commit/bde62951accfc4bb0a516276fd0b4b307e140ce2

Patch

github.com / redis/redis/releases/tag/6.2.19

Release Notes

github.com / redis/redis/releases/tag/7.2.10

Release Notes

github.com / redis/redis/releases/tag/7.4.5

Release Notes

github.com / redis/redis/releases/tag/8.0.3

Release Notes

github.com / redis/redis/security/advisories/GHSA-4q32-c38c-pwgq

Third Party Advisory