CVE-2023-25155

MEDIUM

Redis < 6.0.18 - Authenticated Denial of Service via Integer Overflow in SRANDMEMBER ZRANDMEMBER and HRANDFIELD Commands

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2023-25155. PoCs published by qwqqaqqwq00.

AI-analyzed exploit summary This repository contains Redis module documentation generation scripts and Redis source code files, but no actual exploit code or technical analysis for CVE-2023-25155. The files are related to Redis module API documentation and core Redis functionality, not vulnerability exploitation.

Description

Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SRANDMEMBER`, `ZRANDMEMBER`, and `HRANDFIELD` commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. This problem affects all Redis versions. Patches were released in Redis version(s) 6.0.18, 6.2.11 and 7.0.9.

Exploits (1)

nomisec STUB
by qwqqaqqwq00 · poc
https://github.com/qwqqaqqwq00/opensource_defect_repare_cc

This repository contains Redis module documentation generation scripts and Redis source code files, but no actual exploit code or technical analysis for CVE-2023-25155. The files are related to Redis module API documentation and core Redis functionality, not vulnerability exploitation.

Classification
Stub 95%
Attack Type
Other
Complexity
N/a
Reliability
N/a
Target: Redis (unspecified version)
No auth needed
mistral-large-3 · analyzed Jul 03, 2026 Full analysis →

References (5)

Core 5

Scores

CVSS v3 5.5
EPSS 0.0090
EPSS Percentile 56.3%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-190
Status published
Products (1)
redis/redis < 6.0.18
Published Mar 02, 2023
Tracked Since Feb 18, 2026