CVE-2025-48367

What it actually does

An unauthenticated remote connection triggers repeated IP protocol errors inside Redis, starving legitimate clients and resulting in denial of service.

Why it matters to the business

Redis-based applications experience prolonged outages or degraded performance; the issue affects widely deployed versions across many environments and has seen a modest rise in exploitation probability over the past month.

How an attack unfolds

An attacker opens an unauthenticated TCP connection to a vulnerable Redis instance and transmits specially crafted traffic that repeatedly triggers IP-layer protocol errors, exhausting client-handling resources until the service becomes unresponsive to normal traffic.

How to fix it

Upgrade Redis to 8.0.3, 7.4.5, 7.2.10, or 6.2.19 (or the equivalent Git commit b49d5c0cf4e96a277d4b4e98f61d10c792b37003). For AlmaLinux 9 systems also apply the libxml2 updates to 2.9.13-10.el9_6 on libxml2, libxml2-devel, and python3-libxml2 packages.

How to confirm the fix worked

Confirm the running Redis binary or package reports one of the fixed versions, then verify that new unauthenticated connections no longer produce repeated IP protocol errors under load testing.

Typical attack path

1. Locate an exposed Redis instance
2. Establish an unauthenticated network connection
3. Send crafted packets that induce repeated IP protocol errors
4. Sustain the connection pattern to starve client resources
5. Maintain the flood until the service denies service to legitimate clients

How to detect it

Inspect Redis server logs for clusters of IP protocol error messages originating from the same remote addresses; correlate with connection volume spikes on the Redis listening port.

What your security team should do

• Prioritize upgrade of all internet-facing and internal Redis instances to the listed fixed versions
• Restrict unauthenticated network access to Redis ports using firewalls or TLS client certificates
• Review Redis logs for repeated IP protocol error entries from unexpected sources
• Monitor EPSS trend and re-assess exposure if exploit code appears