CVE-2025-21605

What it actually does

Unauthenticated clients trigger unbounded growth of client output buffers by sending commands that elicit repeated NOAUTH replies, exhausting server memory until the process terminates.

Why it matters to the business

Redis or compatible in-memory database services become unavailable, disrupting applications that rely on them for caching, sessions, or real-time data and potentially causing outages across dependent systems.

How an attack unfolds

An attacker connects to an exposed Redis instance, issues repeated commands without supplying credentials, receives accumulating NOAUTH responses that fill the output buffer, and continues until the server runs out of memory or is killed by the OS.

How to fix it

Upgrade Redis to 7.4.3 or later; for Rocky Linux 8 apply raptor2 2.0.15-17.el8_10; for valkey apply commit f6852069ae1ad969189150a23f9a78644b86a443; alternatively enforce network-level access controls or require TLS with client certificates to block unauthenticated connections.

How to confirm the fix worked

Confirm the running server version reports a fixed release, test that unauthenticated connections are rejected or rate-limited by client-output-buffer-limit settings, and verify memory usage remains stable under repeated unauthenticated command attempts.

Typical attack path

1. Discover an accessible Redis TCP port
2. Establish a connection without authentication
3. Repeatedly issue arbitrary commands to elicit NOAUTH replies
4. Monitor buffer growth until memory exhaustion occurs

How to detect it

Review Redis logs for repeated NOAUTH responses from the same client IP, correlate with sudden memory spikes or OOM killer events, and inspect connection counts from unauthenticated sources.

What your security team should do

• Apply the listed fixed versions or equivalent patches immediately
• Restrict Redis exposure using firewalls or security groups to authenticated clients only
• Enable client-output-buffer-limit for normal clients in configuration
• Monitor for high memory usage correlated with unauthenticated connection volume