CVE-2025-27151 is a Medium severity (CVSS 4.7) stack buffer overflow in the redis-check-aof tool in Redis from 7.0.0 to before 8.0.2. The fix is in Redis 8.0.2. Update, and do not run the tool with untrusted file paths. Scripts that run it deserve a quick review.
What's affected
Affected: Redis from 7.0.0 up to but not including 8.0.2, according to the record. Fixed: 8.0.2. The 8.0.2 release notes list a security fix for CVE-2025-27151.
The GitHub advisory GHSA-5453-q98w-cmvm lists affected versions as 7.0.0 and later, and showed patched versions as to be determined when I read it. If you run a 7.x release and cannot move to 8.0.2, check the advisory and the 7.x release notes for a fix on your branch.
The affected piece is the command line tool redis-check-aof, not the server process. That limits who can reach the flaw.
How to check if you're exposed
Check your Redis version on the server and on any host that has the tools installed:
redis-server --version
redis-cli INFO server | grep redis_version
Then see whether the tool is used in scripts or in runbooks, and whether any path passed to it can come from outside your control:
which redis-check-aof
grep -rn "redis-check-aof" /etc /opt /usr/local/bin ~/ 2>/dev/null | head
The attack needs a user to run the tool with a long file path, and the vector rates the attack as local with high complexity. So unlike a server flaw, the risk centres on automation or people who run the tool with data they did not write.
A dependency scan, such as the free browser scan, helps with container images that bundle Redis tools. Reachability analysis asks whether your code or scripts ever call the vulnerable piece, which is the right question for a tool like this.
What to do now
- Check the Redis version on servers, containers and admin hosts.
- Update to 8.0.2 or later. On older branches, read the advisory and release notes for a fix on your line.
- Review scripts that call
redis-check-aofand make sure file paths come from trusted sources. - Limit who can run Redis tools on production hosts.
- Rebuild container images that bundle Redis so the updated tools ship.
- Keep Redis itself off the public internet and behind authentication.
Why it matters
The record lists CWE-121 (stack based buffer overflow) and CWE-20 (improper input validation). The tool copies a user supplied file path into a fixed size area on the stack using the length of the string, without checking that it fits. A long enough path writes past the end of the area.
The advisory says this may potentially lead to code execution. The CVSS score is Medium, mostly because the attack is local, needs some privileges and is hard to reach in practice, and the impact is scored as availability only. That is a fair way to rank it. The record's KEV flag is false, so it is not in the CISA Known Exploited Vulnerabilities catalog.
This is a good example of a case where severity labels and real exposure differ. If nobody on your team passes untrusted paths to the tool, risk is low. If an automation does, it deserves a quick fix.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this affect the Redis server?
The affected code is in the redis-check-aof tool. The server process is not the described target, although the tool ships in the same package.
Which version fixes it?
Redis 8.0.2, per the record and the release notes. For 7.x, check the advisory and 7.x release notes for a fix on your branch.
Sources
Last reviewed: 19 October 2026.
