Skip to content

Commit cef09d7

Browse files
committed
DOC-5156 RS: Add CVE to 7.22 release notes draft
1 parent 1afad13 commit cef09d7

File tree

1 file changed

+8
-0
lines changed

1 file changed

+8
-0
lines changed

content/operate/rs/release-notes/rs-7-22-releases/rs-7-22-0-28.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -317,8 +317,14 @@ Some CVEs announced for open source Redis do not affect Redis Enterprise Softwar
317317

318318
Redis Enterprise Software 7.22.0-28 supports open source Redis 7.4, 7.2, and 6.2. Below is the list of open source Redis CVEs fixed by version.
319319

320+
Redis 7.4.x:
321+
322+
- (CVE-2025-21605) An unauthenticated client can cause unlimited growth of output buffers until the server runs out of memory or is terminated, which can lead to denial-of-service.
323+
320324
Redis 7.2.x:
321325

326+
- (CVE-2025-21605) An unauthenticated client can cause unlimited growth of output buffers until the server runs out of memory or is terminated, which can lead to denial-of-service.
327+
322328
- (CVE-2024-31449) An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution.
323329

324330
- (CVE-2024-31228) An authenticated user can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as `KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION LIST`, `COMMAND LIST`, and ACL definitions. Matching of extremely long patterns may result in unbounded recursion, leading to stack overflow and process crashes.
@@ -363,6 +369,8 @@ Redis 7.0.x:
363369

364370
Redis 6.2.x:
365371

372+
- (CVE-2025-21605) An unauthenticated client can cause unlimited growth of output buffers until the server runs out of memory or is terminated, which can lead to denial-of-service.
373+
366374
- (CVE-2024-31449) An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution.
367375

368376
- (CVE-2024-31228) An authenticated user can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as `KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION LIST`, `COMMAND LIST`, and ACL definitions. Matching of extremely long patterns may result in unbounded recursion, leading to stack overflow and process crashes.

0 commit comments

Comments
 (0)