{"id":86585,"date":"2026-03-02T00:29:38","date_gmt":"2026-03-02T00:29:38","guid":{"rendered":""},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-30T00:00:00","slug":"cve-2025-48367-unauthenticated-connection-vulnerability-in-redis-leading-to-denial-of-service-dos","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-48367-unauthenticated-connection-vulnerability-in-redis-leading-to-denial-of-service-dos\/","title":{"rendered":"CVE-2025-48367: Unauthenticated Connection Vulnerability in Redis Leading to Denial of Service (DoS)<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The vulnerability CVE-2025-48367 has been identified affecting Redis, an open-source, in-memory database system that persists on disk. The vulnerability is significant as it enables an unauthenticated connection to trigger repeated IP protocol errors, resulting in client starvation and a denial of service. This risk of potential system compromise or data leakage makes it crucial for system administrators and cybersecurity professionals to address this issue promptly.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-48367
\nSeverity: High (CVSS: 7.5)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: Denial of service leading to potential system compromise or data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Redis | < 8.0.3\nRedis | < 7.4.5\nRedis | < 7.2.10\nRedis | < 6.2.19\n\nHow the Exploit Works<\/strong><\/p>\n

The vulnerability exists due to a lack of proper authentication when establishing a connection with the Redis database. An attacker can exploit this by creating an unauthenticated connection, causing the system to generate repeated IP protocol errors. These errors can lead to client starvation, where legitimate client requests are not processed. Over time, this can exhaust the system’s resources, leading to a denial of service. This process can potentially lead to system compromise or data leakage.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Here is a conceptual example of how an attacker might exploit this vulnerability through a network connection:<\/p>\n

CONNECT target.example.com:6379\nSEND { \"malicious_payload\": \"trigger IP protocol errors\" }<\/code><\/pre>\n
The above pseudocode implies that an attacker is forming a connection to the vulnerable Redis server and sending a malicious payload designed to trigger IP protocol errors, leading to a DoS condition.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview The vulnerability CVE-2025-48367 has been identified affecting Redis, an open-source, in-memory database system that persists on disk. The vulnerability is significant as it enables an unauthenticated connection to trigger repeated IP protocol errors, resulting in client starvation and a denial of service. This risk of potential system compromise or data leakage makes it crucial […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-86585","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t