go-redis up to 9.5.4/9.6.2/9.7.2 input validation

Summaryinfo

A vulnerability classified as problematic was found in go-redis up to 9.5.4/9.6.2/9.7.2. This issue affects some unknown processing. Such manipulation leads to an unknown weakness. This vulnerability is traded as CVE-2025-29923. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in go-redis up to 9.5.4/9.6.2/9.7.2 and classified as problematic. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is integrity. CVE summarizes:

go-redis is the official Redis client library for the Go programming language. Prior to 9.5.5, 9.6.3, and 9.7.3, go-redis potentially responds out of order when `CLIENT SETINFO` times out during connection establishment. This can happen when the client is configured to transmit its identity, there are network connectivity issues, or the client was configured with aggressive timeouts. The problem occurs for multiple use cases. For sticky connections, you receive persistent out-of-order responses for the lifetime of the connection. All commands in the pipeline receive incorrect responses. When used with the default ConnPool once a connection is returned after use with ConnPool#Put the read buffer will be checked and the connection will be marked as bad due to the unread data. This means that at most one out-of-order response before the connection is discarded. This issue is fixed in 9.5.5, 9.6.3, and 9.7.3. You can prevent the vulnerability by setting the flag DisableIndentity to true when constructing the client instance.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2025-29923 since 03/12/2025. The exploitation is known to be difficult. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 240835 (SUSE SLES15 / openSUSE 15 Security Update : grafana (SUSE-SU-2025:01991-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 9.5.5, 9.6.3 or 9.7.3 eliminates this vulnerability. Applying the patch d236865b0cfa1b752ea4b7da666b1fdcd0acebb6 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (240835) and CERT Bund (WID-SEC-2025-0633). Once again VulDB remains the best source for vulnerability data.

Affected

• Red Hat Enterprise Linux
• Fedora Linux
• SUSE Linux
• Oracle Linux
• SUSE openSUSE
• Open Source Gitea
• Red Hat OpenShift
• IBM Storage Scale

Productinfo

Name

• go-redis

Version

• 9.5.0
• 9.5.1
• 9.5.2
• 9.5.3
• 9.5.4
• 9.6.0
• 9.6.1
• 9.6.2
• 9.7.0
• 9.7.1
• 9.7.2

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion