Integer underflow in Valkey - CVE-2025-49112

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU118804

Integer underflow in Valkey - CVE-2025-49112

Published: November 27, 2025


Vulnerability identifier: #VU118804
CSH Severity: Low
CVSS v4: 2.3 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-49112
CWE-ID: CWE-191
Exploitation vector: Adjecent network
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to an integer underflow within the setDeferredReply() function in networking.c. A remote attacker can send a specially crafted request to the affected application, trigger an integer underflow and perform a denial of service attack. 


Affected software

Valkey
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
Fedora
Server Applications Module
openEuler
Ubuntu
pymol
redis
redis-debuginfo
redis-debugsource
valkey (Ubuntu package)
valkey-compat-redis
valkey
valkey-devel
valkey-debugsource
valkey-debuginfo

How to mitigate CVE-2025-49112

Install updates from vendor's website.

Valkey - addressed in versions 7.2.11, 8.0.6, 8.1.4
pymol - update to 3.1.0-4.fc43
redis - update to 7.2.9-2
redis-debuginfo - update to 7.2.9-2
redis-debugsource - update to 7.2.9-2
valkey (Ubuntu package) - addressed in versions 7.2.11+dfsg1-0ubuntu0.2, 8.0.6+dfsg1-0ubuntu0.2, 8.1.4+dfsg1-0ubuntu0.2
valkey-compat-redis - update to 8.0.2-150700.3.5.1
valkey - update to 8.0.2-150700.3.5.1
valkey-devel - update to 8.0.2-150700.3.5.1
valkey-debugsource - update to 8.0.2-150700.3.5.1
valkey-debuginfo - update to 8.0.2-150700.3.5.1
valkey - addressed in versions 8.0.3-2.el8, 8.0.3-2.el9, 8.0.3-2.fc42, 8.0.3-3.el9, 8.0.3-3.fc41, 8.0.3-3.fc42

External References

Related Security Bulletins