CVE-2023-28425
MediumStarting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process.
Published Mar 20, 2023 · Updated Sep 8, 2026 · Also known as BIT-keydb-2023-28425, BIT-redis-2023-28425, BIT-valkey-2023-28425, DEBIAN-CVE-2023-28425, GHSA-mvmm-4vq6-vw8c, UBUNTU-CVE-2023-28425
Key Facts
Patch immediately- CVE-2023-28425 is a medium-severity vulnerability (CVSS 5.5 v3.1) affecting Redis, keydb (bitnami), valkey (bitnami) and 5 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 59% probability of exploitation in the next 30 days.
- Fixed versions are available, including keydb 7.0.10, Redis 5:7.0.10-1, Redis 6.2.11-1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS (30-day exploit likelihood)
59%
Higher than 99.0% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2023-28425 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in Redis version 7.0.10.
Affected Products
28 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| RedisRedis | >= 7.0.8, >= >= 7.0.8, < 7.0.10 | 7.0.10 |
| keydbbitnami | >= 7.0.8 | 7.0.10 |
| valkeybitnami | >= 7.0.8 | 7.0.10 |
| redis6-develamazon | See advisory | 6.2.12-1.amzn2023.0.1 |
| redis6amazon | See advisory | 6.2.12-1.amzn2023.0.1 |
Patched Releases
keydb
7.0.10
Redis
5:7.0.10-1, 6.2.11-1, 6.2.12-1, 7.0.10, 7.0.11-1.1, 7.0.12-1.ph5
redis6
6.2.12-1.amzn2023.0.1
redis6-devel
6.2.12-1.amzn2023.0.1
redis6-doc
6.2.12-1.amzn2023.0.1
redis7
7.0.8-150500.3.3.1
valkey
7.0.10
Timeline
Publicly disclosed
Mar 20, 2023
Last updated
Sep 8, 2026
Weakness Type
- CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
- CWE-617 Reachable Assertion
References
- advisoryhttps://bugzilla.suse.com/1208790
- advisoryhttps://bugzilla.suse.com/1208793
- advisoryhttps://bugzilla.suse.com/1209528
- advisoryhttps://bugzilla.suse.com/1210548
- advisoryhttps://bugzilla.suse.com/1213193
FAQ
Common Questions.
Redis is an in-memory database that persists on disk.
Affected: Redis versions >= 7.0.8, >= >= 7.0.8, < 7.0.10; keydb (bitnami) versions >= 7.0.8; valkey (bitnami) versions >= 7.0.8, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including keydb 7.0.10, Redis 5:7.0.10-1, Redis 6.2.11-1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2023-28425 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo