onyx --cves cve-2023-25155

CVE-2023-25155

score: <0.1
cvss: 5.5
epss: 0.9%
published: 2023-03-02
kev added: —
first seen: 2026-10-21

Redis contains an integer overflow caused by specially crafted SRANDMEMBER, ZRANDMEMBER, and HRANDFIELD commands, letting authenticated users cause a runtime assertion and terminate the server, exploit requires authenticated access.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

2023-03-02 Published
2026-10-21 Tracked by Onyx
2026-10-21 Public PoC

Exploit availability

Public PoC flagged by vulnx; no direct exploit link among the citations.

Weaknesses

CWE-190

References 5

https://github.com/redis/redis/commit/2a2a582e7cd99ba3b531336b8bd41df2b566e619
https://github.com/redis/redis/releases/tag/6.0.18
https://github.com/redis/redis/releases/tag/6.2.11
https://github.com/redis/redis/releases/tag/7.0.9
https://github.com/redis/redis/security/advisories/GHSA-x2r7-j9vw-3w83