CVE-2025-29923

Executive Summary

CVE-2025-29923 is a vulnerability in the official Redis client library for Go, go-redis. The issue arises when the CLIENT SETINFO command times out during connection establishment, causing the client to potentially process responses out of order. This can lead to incorrect command responses, affecting data integrity and application logic. The vulnerability is rated with a CVSS score of 3.7 (Low), but its impact is significant in environments where data consistency is critical. The fix is available in versions 9.5.5, 9.6.3, and 9.7.3, and a workaround exists by disabling the identity feature.

Supply Chain & Package Security

This vulnerability affects the go-redis package, which is a widely used Go library for interacting with Redis. Organizations using go-redis in their Go applications should immediately update to the patched versions to prevent potential data corruption. The package is distributed via the Go module proxy, and developers should verify the integrity of the updated module.

CVSS Breakdown & Threat Level

• CVSS Score: 3.7 (Low)
• Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: High
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

The low score is due to the high attack complexity and limited integrity impact. However, in scenarios where data consistency is paramount, this vulnerability can have cascading effects.

Deep Dive & Mechanics

The vulnerability occurs during the connection establishment phase when go-redis sends a CLIENT SETINFO command to identify the client. If this command times out due to network issues or aggressive timeouts, the client may not properly synchronize the response order. This can result in subsequent commands receiving responses intended for previous commands, leading to out-of-order processing.

For sticky connections, this issue persists for the lifetime of the connection, causing all pipeline commands to receive incorrect responses. For connections managed by the default ConnPool, the read buffer is checked upon returning the connection, and if unread data is detected, the connection is marked as bad. This limits the impact to at most one out-of-order response per connection.

The root cause is a race condition in the connection setup logic, where the timeout handling does not properly reset the response state.

Vulnerable vs. Patched Code

Vulnerable Code (pre-9.5.5):

// In connection setup, CLIENT SETINFO is sent without proper timeout handling
err := conn.WriteCmd("CLIENT", "SETINFO", "lib-name", "go-redis")
if err != nil {
    // Timeout or error not handled correctly
}
// Subsequent commands may read stale responses

Patched Code (9.5.5+):

// Properly handle timeout and reset response state
err := conn.WriteCmd("CLIENT", "SETINFO", "lib-name", "go-redis")
if err != nil {
    // Clear any pending responses
    conn.Discard()
    return err
}
// Ensure response order is maintained

The patch ensures that if CLIENT SETINFO fails, any pending responses are discarded, preventing out-of-order processing.

Exploitation & Lab Setup

Red Team

To simulate the vulnerability, set up a Go application using go-redis version 9.5.4 or earlier. Configure the client with aggressive timeouts and network latency to trigger the timeout condition.

Lab Setup:

1. Install Go and create a new module.
2. Add go-redis v9.5.4 as a dependency.
3. Write a script that establishes a connection and sends multiple commands.
4. Use a network tool (e.g., tc on Linux) to introduce latency or packet loss.

Exploit Script:

package main

import (
    "context"
    "fmt"
    "time"
    "github.com/redis/go-redis/v9"
)

func main() {
    rdb := redis.NewClient(&redis.Options{
        Addr:         "localhost:6379",
        DialTimeout:  1 * time.Second,
        ReadTimeout:  1 * time.Second,
        WriteTimeout: 1 * time.Second,
    })

    ctx := context.Background()
    // Trigger CLIENT SETINFO timeout
    _, err := rdb.Ping(ctx).Result()
    if err != nil {
        fmt.Println("Error:", err)
    }

    // Subsequent commands may get out-of-order responses
    val, err := rdb.Get(ctx, "key").Result()
    if err != nil {
        fmt.Println("Error:", err)
    }
    fmt.Println("Value:", val)
}

Blue Team

To detect exploitation attempts, monitor for unusual connection patterns or timeouts in Redis logs. Use the detection rules below to identify out-of-order responses.

Indicators of Compromise (IOCs)

• Network: Unusual TCP retransmissions or timeouts on Redis port 6379.
• Logs: Redis logs showing repeated CLIENT SETINFO failures.
• Application: Unexpected values returned from Redis commands, indicating response misordering.

Detection Engineering

YARA Rule

rule CVE_2025_29923_go_redis {
    meta:
        description = "Detects go-redis versions vulnerable to CVE-2025-29923"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-29923"
    strings:
        $vuln_version1 = "go-redis v9.5.4"
        $vuln_version2 = "go-redis v9.6.2"
        $vuln_version3 = "go-redis v9.7.2"
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-29923 - go-redis Out-of-Order Response
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential exploitation of CVE-2025-29923 via out-of-order Redis responses
logsource:
    category: application
    product: go-redis
detection:
    selection:
        event: "response_mismatch"
    condition: selection
falsepositives:
    - Network latency issues
level: medium

Suricata Rule

alert tcp any any -> any 6379 (msg:"CVE-2025-29923 - go-redis Out-of-Order Response"; flow:to_server; content:"|2a|"; depth:1; content:"CLIENT SETINFO"; nocase; within:50; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Update go-redis to version 9.5.5, 9.6.3, or 9.7.3.
2. Workaround: Set DisableIdentity: true when constructing the client.
3. Network: Ensure stable network connectivity to Redis servers.
4. Monitoring: Implement logging for connection timeouts and response mismatches.

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.