go-redis allows potential out of order responses when `CLIENT SETINFO` times out during connection establishment
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 19 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
go-redis is the official Redis client library for the Go programming language. Prior to 9.5.5, 9.6.3, and 9.7.2, go-redis potentially responds out of order when `CLIENT SETINFO` times out during connection establishment. This can happen when the client is configured to transmit its identity, there are network connectivity issues, or the client was configured with aggressive timeouts. The problem occurs for multiple use cases. For sticky connections, you receive persistent out-of-order responses for the lifetime of the connection. All commands in the pipeline receive incorrect responses. When used with the default ConnPool once a connection is returned after use with ConnPool#Put the read buffer will be checked and the connection will be marked as bad due to the unread data. This means that at most one out-of-order response before the connection is discarded. This issue is fixed in 9.5.5, 9.6.3, and 9.7.2; however, 9.7.2 has been yanked and 9.7.3 is the lowest available patched version on the 9.7.x branch. As a workaround, set the flag `DisableIndentity` to `true` when constructing the client instance.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Redis | go-redis | 9.7.0-beta.1 to before 9.7.2; 9.6.0b1 to before 9.6.3; 9.5.1 to before 9.5.5 | 9.7.2, 9.6.3, 9.5.5 | Patch available | CNA |
| — | github.com/redis/go-redis/v9 (Go) | 9.7.0-beta.1 to before 9.7.3 | 9.7.3 | Patch available | GHSA-92cp-5422-2mw7 |
| — | github.com/redis/go-redis/v9 (Go) | 9.6.0b1 to before 9.6.3 | 9.6.3 | Patch available | GHSA-92cp-5422-2mw7 |
| — | github.com/redis/go-redis/v9 (Go) | 9.5.1 to before 9.5.5 | 9.5.5 | Patch available | GHSA-92cp-5422-2mw7 |
- go-redis VendorRedis Affected 9.7.0-beta.1 to before 9.7.2; 9.6.0b1 to before 9.6.3; 9.5.1 to before 9.5.5 Fixed in 9.7.2, 9.6.3, 9.5.5 Patch available CNA
- github.com/redis/go-redis/v9 (Go) Vendor— Affected 9.7.0-beta.1 to before 9.7.3 Fixed in 9.7.3 Patch available GHSA-92cp-5422-2mw7
- github.com/redis/go-redis/v9 (Go) Vendor— Affected 9.6.0b1 to before 9.6.3 Fixed in 9.6.3 Patch available GHSA-92cp-5422-2mw7
- github.com/redis/go-redis/v9 (Go) Vendor— Affected 9.5.1 to before 9.5.5 Fixed in 9.5.5 Patch available GHSA-92cp-5422-2mw7
Remediation
- Fix · CNA go-redis (redis) Fixed in 9.7.2, 9.6.3, 9.5.5
- Fix · GHSA-92cp-5422-2mw7 github.com/redis/go-redis/v9 (Go) Fixed in 9.7.3 Advisory →
- Fix · GHSA-92cp-5422-2mw7 github.com/redis/go-redis/v9 (Go) Fixed in 9.6.3 Advisory →
- Fix · GHSA-92cp-5422-2mw7 github.com/redis/go-redis/v9 (Go) Fixed in 9.5.5 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 4 | Affected | No fix yet: Fix deferred |
| Custom Metric Autoscaler operator for Red Hat Openshift | Affected | No fix yet: Fix deferred |
| Logging Subsystem for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| Multiarch Tuning Operator | Affected | No fix yet: Fix deferred |
| Multicluster Global Hub | Affected | No fix yet: Fix deferred |
| OpenShift Serverless | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 5 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 6 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 8 | Affected | No fix yet: Fix deferred |
| Red Hat Developer Hub 1 | Affected | No fix yet: Fix deferred |
| Red Hat Edge Manager preview | Affected | No fix yet |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift GitOps | Affected | No fix yet: Fix deferred |
| Red Hat Trusted Artifact Signer | Affected | No fix yet: Fix deferred |
| Red Hat Trusted Profile Analyzer | Affected | No fix yet: Fix deferred |
Not affected: 1 product
- Red Hat Edge Manager preview
Timeline
- 2026-10-02 Threatist record created from CVE-2025-29923
- 2026-10-03 Alias added: GHSA-92cp-5422-2mw7
- 2026-10-27 Affected versions changed · Red Hat
References
More Redis vulnerabilities
- TI-2022-00463 Missing authorization in Debian redis KEVCVSS 3.1CRITICAL 10.0
- TI-2025-31759 Redis Lua Use-After-Free may lead to remote code execution CVSS 3.1CRITICAL 10.0
- TI-2023-15161 Redis raft master-1b8bd86 to master-7b46079 was discovered to contain an ODR violation… CVSS 3.1CRITICAL 9.8
- TI-2023-18618 Heap overflow in COMMAND GETKEYS and ACL evaluation in Redis CVSS 3.1HIGH 8.8
- TI-2024-20813 Lua library commands may lead to stack overflow and RCE in Redis CVSS 3.1HIGH 8.8
- TI-2022-08647 Heap overflow issue with the Lua cjson library used by Redis CVSS 3.1HIGH 8.8
Sources
- CVE-2025-29923 · CVE Program
- CVE-2025-29923 · NVD
- FIRST EPSS
- GHSA-92cp-5422-2mw7 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-29923 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences