Executive brief
Go-redis is a popular Redis client library for Go. During connection setup, the client may send a CLIENT SETINFO command that can timeout due to network issues or aggressive timeout settings. When this occurs, the client's response buffer becomes desynchronized, causing it to receive responses to the wrong commands. This can lead to data corruption or application logic errors, particularly in systems using sticky connections or pipelined commands.
Technical details
This vulnerability is a response ordering bug triggered when the CLIENT SETINFO command times out during Redis connection establishment. The root cause is improper handling of the read buffer when the identity-transmission handshake fails to complete within the configured timeout. The vulnerability requires specific preconditions: the client must be configured with identity transmission enabled (default), and either network connectivity issues or aggressive timeouts must occur. An attacker cannot directly trigger this but can exploit timing conditions to cause timeouts. The impact manifests differently based on connection pooling strategy: sticky connections receive persistent out-of-order responses for the connection lifetime, pipelined commands all receive mismatched responses, or pooled connections may be marked as bad after a single out-of-order response. Patches are available in versions 9.5.5, 9.6.3, and 9.7.3 (9.7.2 was yanked). A workaround exists: disable identity transmission by setting the DisableIndentity flag to true when constructing the client.
Affected products
- Redis go-redis >= 9.5.1, < 9.5.5; >= 9.6.0-beta.1, < 9.6.3; >= 9.7.0-beta.1, <= 9.7.1
Timeline
- 2025-03-20: disclosed: Vulnerability disclosed in GHSA-92cp-5422-2mw7
- 2025-03-20: patched: Patches released in versions 9.5.5, 9.6.3, and 9.7.3