Skip to content
Fencer Vulns
low 3.7

CVE-2025-29923 json

go-redis allows potential out of order responses when `CLIENT SETINFO` times out during connection establishment

published 2025-03-20 19 mo ago modified 2026-09-10 1 mo ago also GHSA-92cp-5422-2mw7 , GO-2025-3540 , EUVD-2025-7158

cvss
3.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 55%
public exploits
0
none known

Summary

go-redis is the official Redis client library for the Go programming language. Prior to 9.5.5, 9.6.3, and 9.7.2, go-redis potentially responds out of order when `CLIENT SETINFO` times out during connection establishment. This can happen when the client is configured to transmit its identity, there are network connectivity issues, or the client was configured with aggressive timeouts. The problem occurs for multiple use cases. For sticky connections, you receive persistent out-of-order responses for the lifetime of the connection. All commands in the pipeline receive incorrect responses. When used with the default ConnPool once a connection is returned after use with ConnPool#Put the read buffer will be checked and the connection will be marked as bad due to the unread data. This means that at most one out-of-order response before the connection is discarded. This issue is fixed in 9.5.5, 9.6.3, and 9.7.2; however, 9.7.2 has been yanked and 9.7.3 is the lowest available patched version on the 9.7.x branch. As a workaround, set the flag `DisableIndentity` to `true` when constructing the client instance.

Patch / fix

  • go github.com/redis/go-redis/v9 9.5.5, 9.6.3, 9.7.3
  • rekor SLE Module for Basesystem 15 SP7, openSUSE Leap 15.6 1.4.3-150400.4.28.1
  • grafana SLE Module for Package Hub 15 SP7, SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6 11.5.5-150200.3.72.2
  • grafana Manager Client Tools 15 11.5.5-150000.1.79.1
  • prometheus-blackbox_exporter openSUSE Leap 15.6, Manager Proxy Module 4.3, Manager Client Tools for SLE Micro 5 +1 more 0.26.0-150000.1.27.1
  • golang-github-prometheus-prometheus Manager Client Tools 15 2.53.4-150000.3.62.2
  • grafana Manager Client Tools 12 11.5.5-1.79.2
  • prometheus-blackbox_exporter Manager Client Tools 12 0.26.0-1.27.1
  • golang-github-prometheus-prometheus Manager Client Tools 12 2.53.4-1.60.2

suse advisories SUSE-SU-2026:0383-1SUSE-SU-2025:01991-1SUSE-SU-2025:01989-1SUSE-SU-2025:01987-1

  • grafana openSUSE Leap 16.0 11.6.14+security04-bp160.1.1
  • rekor openSUSE Tumbleweed 1.4.1-1.1
  • grafana openSUSE Tumbleweed 11.5.4-1.1
  • govulncheck-vulndb openSUSE Tumbleweed 0.0.20250327T184518-1.1

opensuse advisories openSUSE-SU-2026:20940-1openSUSE-SU-2025:15508-1openSUSE-SU-2025:15052-1openSUSE-SU-2025:14937-1

  • telegraf Azure Linux 3.0 1.31.0-27
  • keda Azure Linux 3.0 2.14.1-5

azure linux advisories AZL-59156AZL-59192

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-29923 updated cvss 3.7

github.com/redis/go-redis: go-redis allows potential out of order responses when `CLIENT SETINFO` times out during connection establishment

  • Red Hat Cryostat 4 cryostat/cryostat-storage-rhel9 Red Hat Custom Metric Autoscaler operator for Red Hat Openshift custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8, custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9, custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel8, custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9, custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator, custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel8, +1 more Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/logging-loki-rhel9 Red Hat Multiarch Tuning Operator multiarch-tuning/multiarch-tuning-rhel9-operator, multiarch-tuning/multiarch-tuning-operator-bundle Red Hat Multicluster Global Hub multicluster-globalhub/multicluster-globalhub-grafana-rhel9 Red Hat OpenShift Serverless openshift-serverless-1/kn-plugin-event-sender-rhel8
    +5 more products
    Red Hat Advanced Cluster Management for Kubernetes 2 flightctl, flightctl-agent, flightctl-selinux, rhacm2/acm-grafana-rhel9, rhacm2/acm-flightctl-api-rhel9, rhacm2/acm-flightctl-worker-rhel9, +1 more Red Hat Ceph Storage 5 rhel9/grafana, rhceph/grafana-rhel9 Red Hat Ceph Storage 6 rhel9/grafana, rhceph/grafana-rhel9 Red Hat Ceph Storage 8 rhel9/grafana, rhceph/grafana-rhel9, rhceph/oauth2-proxy-rhel9 Red Hat Developer Hub 1 rhdh-orchestrator-dev-preview-beta/controller-rhel9-operator
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Edge Manager preview flightctl, rhem/flightctl-ui-rhel9, rhem/flightctl-api-rhel9, rhem/flightctl-ui-ocp-rhel9, rhem/flightctl-worker-rhel9, rhacm2/acm-flightctl-api-rhel9, +3 more
    affected: workaround, no fix available
  • Red Hat Enterprise Linux 9 grafana, grafana-selinux Red Hat Enterprise Linux 10 grafana Red Hat OpenShift Container Platform 4 redhat/redhat-operator-index, openshift4/ose-operator-registry, openshift4/oc-mirror-plugin-rhel8, openshift4/oc-mirror-plugin-rhel9, openshift4/ose-operator-lifecycle-manager, openshift4/ose-operator-framework-tools-rhel9, +1 more Red Hat OpenShift Dev Spaces devspaces/traefik-rhel9 Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9, openshift-gitops-1/gitops-operator-bundle Red Hat Trusted Artifact Signer rhtas/rekor-cli-rhel9, rhtas/rekor-server-rhel9, rhtas/rekor-backfill-redis-rhel9
    +1 more products
    Red Hat Trusted Profile Analyzer rhtpa/rhtpa-guac-rhel9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Edge Manager preview rhem/flightctl-periodic-rhel9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
19 mo ago

Exploit prediction

0.75% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
GitHub 3.1 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected packages

ecosystem package affected fixed in
go github.com/redis/go-redis/v9
>=9.7.0-beta.1, <9.7.3
>=9.6.0b1, <9.6.3
>=9.5.1, <9.5.5
<9.6.3
9.7.3
9.6.3
9.5.5
go github.com/redis/go-redis
all versions
 no fix listed
go github.com/redis/go-redis/v7
all versions
 no fix listed
go github.com/redis/go-redis/v8
all versions
 no fix listed

Affected products

  • redis go-redis

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.