CVE-2025-21605: Redis Database DoS Vulnerability

CVE-2025-21605 Overview

CVE-2025-21605 is a resource exhaustion vulnerability affecting Redis, the popular open source in-memory database. This flaw allows unauthenticated clients to cause unlimited growth of output buffers on the Redis server, ultimately leading to memory exhaustion and service denial. The vulnerability exists because Redis's default configuration does not impose limits on output buffers for normal clients, allowing malicious actors to consume all available server memory without authentication.

Even when password authentication is enabled on the Redis server, an unauthenticated client can still exploit this vulnerability. By repeatedly triggering "NOAUTH" error responses without providing credentials, an attacker can force the output buffer to grow continuously until the system runs out of memory, causing a complete denial of service.

Critical Impact

Unauthenticated attackers can exhaust Redis server memory through unlimited output buffer growth, causing complete service unavailability and potential system crashes.

Affected Products

• Redis versions 2.6 through 7.4.2
• LFProjects Valkey (prior to version 8.1.1)
• Debian Linux 11.0

Discovery Timeline

• 2025-04-23 - CVE CVE-2025-21605 published to NVD
• 2025-11-14 - Last updated in NVD database

Technical Details for CVE-2025-21605

Vulnerability Analysis

This vulnerability stems from a resource allocation without limits weakness (CWE-770) in how Redis handles client output buffers. The client-output-buffer-limit configuration directive, which controls the maximum size of output buffers, is not set for normal clients by default. This design decision leaves Redis servers vulnerable to memory exhaustion attacks from any network-accessible client.

The attack is particularly dangerous because it bypasses authentication requirements. When an attacker connects to a password-protected Redis instance without providing credentials, the server responds with "NOAUTH" error messages. Each of these responses is buffered in the client's output buffer, which grows without bounds. By maintaining the connection and continuously generating these error responses, the attacker can force unbounded memory allocation until the Redis process is killed by the operating system's out-of-memory (OOM) killer or the entire system becomes unresponsive.

Root Cause

The root cause is the absence of default limits on client output buffers for normal (non-replica, non-pubsub) clients. Redis versions starting from 2.6 do not restrict how much memory can be consumed by output buffers associated with individual client connections. The client-output-buffer-limit normal directive defaults to unlimited (0 0 0), meaning there are no hard limits, soft limits, or timeout thresholds for normal client output buffers.

Attack Vector

This vulnerability is exploitable over the network by unauthenticated attackers. The attack requires no prior authentication, no user interaction, and has low complexity to execute. An attacker simply needs network access to the Redis port (default 6379) and can initiate the attack by:

1. Establishing a TCP connection to the Redis server
2. Sending commands that generate responses (or simply remaining connected to receive error messages)
3. Not reading responses from the socket, causing the output buffer to accumulate
4. Repeating until memory is exhausted

The attack is effective even against password-protected Redis instances, as the "NOAUTH Authentication required" error messages themselves consume buffer space.

Detection Methods for CVE-2025-21605

Indicators of Compromise

• Unusual memory growth on Redis server processes without corresponding increase in legitimate workload
• Redis INFO memory output showing abnormally high client_output_buffer_list_length values
• Connection patterns showing clients that maintain connections but do not consume responses
• OOM killer events terminating Redis processes unexpectedly

Detection Strategies

• Monitor Redis memory usage via redis-cli INFO memory and alert on unusual growth patterns
• Track client connections using CLIENT LIST command, looking for clients with high omem (output memory) values
• Implement network-level monitoring for connections to Redis port that remain idle or show asymmetric traffic patterns
• Set up process monitoring to detect Redis restarts caused by memory exhaustion

Monitoring Recommendations

• Configure alerting on Redis memory usage exceeding normal operational thresholds
• Use Redis Sentinel or similar monitoring to track instance health and memory metrics
• Implement connection rate limiting at the network level to detect connection flooding attempts
• Enable Redis slowlog and monitor for unusual command patterns from unauthenticated sources

How to Mitigate CVE-2025-21605

Immediate Actions Required

• Upgrade Redis to version 7.4.3 or later immediately
• If using Valkey, upgrade to version 8.1.1 or later
• Review and restrict network access to Redis instances using firewalls, security groups, or iptables
• Configure client-output-buffer-limit normal to set appropriate hard and soft limits

Patch Information

Redis has addressed this vulnerability in version 7.4.3. The patch introduces proper handling of output buffer limits to prevent unbounded memory growth from unauthenticated clients. For detailed information, refer to the GitHub Security Advisory GHSA-r67f-p999-2gff and the Redis 7.4.3 Release Notes.

For Valkey users, the fix is available in version 8.1.1. Debian users should refer to the Debian LTS Announcement for updated packages.

Workarounds

• Block unauthenticated access to Redis using network firewalls, iptables rules, or cloud security groups
• Enable TLS on Redis and require client-side certificate authentication
• Bind Redis only to trusted network interfaces (avoid binding to 0.0.0.0)
• Place Redis behind a VPN or bastion host to limit network exposure

# Configuration example - Add to redis.conf
# Set output buffer limits for normal clients
# Format: client-output-buffer-limit <class> <hard limit> <soft limit> <soft seconds>
client-output-buffer-limit normal 256mb 64mb 60

# Bind to localhost only if external access is not required
bind 127.0.0.1

# Require password authentication
requirepass your_strong_password_here

# Enable protected mode (blocks external connections when no password is set)
protected-mode yes